Submission Details
Severity:
Reentrancy Risk in Donation
Summary
The donate function is vulnerable to reentrancy attacks due to state updates after external calls.
Vulnerability Details
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
_mint(msg.sender, tokenCounter);
// ... state updates after external call
}
Impact
Multiple NFT mints possible in single donation
Inconsistent state
Potential fund loss
Tools Used
Slither
Manual Review
Recommendations
function donate(address charity) public payable nonReentrant {
require(registry.isVerified(charity), "Charity not verified");
uint256 tokenId = tokenCounter;
tokenCounter += 1;
_mint(msg.sender, tokenId);
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenId, uri);
emit DonationMade(msg.sender, charity, msg.value, tokenId);
}
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.