Submission Details
Severity:
Unrestricted Registry Update Access
Summary
The updateRegistry function in GivingThanks contract lacks access control, allowing any address to modify the registry address.
Vulnerability Details
function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}
The function has no access restrictions, enabling any caller to change the registry address to an arbitrary contract.
Impact
Any user can change the registry address
Potential bypass of charity verification
Complete compromise of donation validation system
Loss of funds through unauthorized donations
Tools Used
Manual Review
Recommendations
contract GivingThanks is ERC721URIStorage, Ownable {
event RegistryUpdated(address indexed oldRegistry, address indexed newRegistry);
function updateRegistry(address _registry) public onlyOwner {
require(_registry != address(0), "Invalid registry address");
address oldRegistry = address(registry);
registry = CharityRegistry(_registry);
emit RegistryUpdated(oldRegistry, _registry);
}
}
Updates
Lead Judging Commences
n0kto 8 months ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-change-registry
Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.