The CharityRegistry
smart contract has a misleading isVerified
function that checks if a charity is registered rather than verified.
The isVerified
function currently checks if a charity is registered, not verified, which is misleading and can lead to incorrect behavior in the donate
function. The donate
function relies on isVerified
to ensure that only verified charities can receive donations and mint NFTs. This discrepancy can allow registered but unverified charities to receive donations and mint NFTs.
Registered charities that are not verified can receive donations and mint NFTs.
Undermines the integrity and trustworthiness of the platform.
Donors might unknowingly donate to unverified charities.
Manual Review
Update the isVerified
function to check if a charity is verified instead of just registered.
Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.