GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

The wrong address is passed when initializing the `GivingThanks::registry` contract inside `GivingThanks` constructor.

xilobytes

Description In the constructor of the GivingThanks contract, the parameter _registry is not passed to the CharityRegistry contract, but the address of the msg.sender instead.

Impact This issue affects the GivingThanks::registry variable, since it's initialized to a CharityRegistry contract that doesn't exist.

Proof of Concepts

Add the following test to Test.t.sol.

function testWrongParameterIsPassedToCharityRegistryContract() public{
assertEq(address(charityContract.registry()), admin);
}

Recommended mitigation Pass the proper parameter during the initialization of the GivingThanks::registry variable.

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
- registry = CharityRegistry(msg.sender);
+ registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.