GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong verification at `CharityRegistry:isVerified` function

edmpulasky

Summary

registeredCharities mapping is intended for registering only not verify.

Vulnerability Details

CharityRegistry:isVerified function uses registeredCharities instead of verifiedCharities to properly determine Charities verification.

function isVerified(address charity) public view returns (bool) {
//registeredCharities for register only
@> return registeredCharities[charity];
}

Impact

Any registered Charity is able to receive donations at GivingThanks:donate.

Tools Used

  • Manual Review

  1. Donor: Calls donate to an any charity.

  2. Charity: At least registered bypasses CharityRegistry:isVerified check.

  3. Charity: Receives donation amount.

  4. Donor: Receives the Donation Receipt NFT.

function testRegisteredCharitiesReceiveDonations() public {
address anyCharity = makeAddr("anyCharity");
//only register
registryContract.registerCharity(anyCharity);
vm.deal(donor, 10 ether);
vm.prank(donor);
charityContract.donate{ value: 1 ether }(anyCharity);
​
assertEq(anyCharity.balance, 1 ether);
}

Recommendations

  • use verifiedCharities as it should.

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!