GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[L-1] Incorrect initialisation of `registry` in `GivingThanks::constructor`, causing that the deployment of this contract will be useless

jumpupjoran

Summary

In the GivingThanks::constructor the registry get wrongly initialized. It passed the address of msg.sender instead of the address of the dpeoloyed CharityRegistry. Causing that this contract won't work untill the address of the registry is changed in the updateRegistry function.

Vulnerability Details

found in line 17 in GivingThanks.sol

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
@> registry = CharityRegistry(msg.sender);
owner = msg.sender;
tokenCounter = 0;
}
​

Impact

No functionality will work untill the address of the registry has been updated

Tools Used

Manual review

Recommendations

replace msg.sender with _registry.

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
- registry = CharityRegistry(msg.sender);
+ registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.