GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized Registry Update

elminnyc

Summary

The GivingThanks smart contract has a security vulnerability in the updateRegistry function, allowing any user to change the registry contract address.

Vulnerability Details

The updateRegistry function allows any user to change the registry contract address. This can lead to severe security vulnerabilities, where a malicious user could point the registry to a contract they control, thereby manipulating the verification process and potentially redirecting donations.

Impact

Any user can replace the CharityRegistry with a malicious contract.

Tools Used

Manual Review

Recommendations

Restrict access to the updateRegistry function so that only the contract owner can perform this action.

function updateRegistry(address _registry) public {
require(msg.sender == owner, "Only the owner can update the registry");
registry = CharityRegistry(_registry);
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.