GivingThanks

First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Misleading isVerified Function

Summary

The CharityRegistry smart contract has a misleading isVerified function that checks if a charity is registered rather than verified.

Vulnerability Details

The isVerified function currently checks if a charity is registered, not verified, which is misleading and can lead to incorrect behavior in the donate function. The donate function relies on isVerified to ensure that only verified charities can receive donations and mint NFTs. This discrepancy can allow registered but unverified charities to receive donations and mint NFTs.

Impact

  • Registered charities that are not verified can receive donations and mint NFTs.

  • Undermines the integrity and trustworthiness of the platform.

  • Donors might unknowingly donate to unverified charities.

Tools Used

Manual Review

Recommendations

Update the isVerified function to check if a charity is verified instead of just registered.

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.