Misleading isVerified Function
Summary
The CharityRegistry smart contract has a misleading isVerified function that checks if a charity is registered rather than verified.
Vulnerability Details
The isVerified function currently checks if a charity is registered, not verified, which is misleading and can lead to incorrect behavior in the donate function. The donate function relies on isVerified to ensure that only verified charities can receive donations and mint NFTs. This discrepancy can allow registered but unverified charities to receive donations and mint NFTs.
Impact
Registered charities that are not verified can receive donations and mint NFTs.
Undermines the integrity and trustworthiness of the platform.
Donors might unknowingly donate to unverified charities.
Tools Used
Manual Review
Recommendations
Update the isVerified function to check if a charity is verified instead of just registered.
Lead Judging Commences
finding-isVerified-return-registered-charities
Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.