GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Improper Access Control lets anyone update `registry` address by calling `GivingThanks::updateRegistry()`

imdheeraj28

Summary

Access Control has not been implemented for the GivingThanks::updateRegistry()function. This lets anyone being able to call this function.

Vulnerability Details

Any malicious user could call the updateRegistry() function and change the registry contract.

Impact

This would add another contract as the registry which the user has created. The protocol would not behave as expected. Also, the user may be able to steal charity donations with updated logic.

Tools Used

Manual

Recommendations

Add a check to ensure only the admin can call this function.

require(msg.sender == owner, "Not authorised");
Updates

Lead Judging Commences

imdheeraj28 Submitter
8 months ago
n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.