GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong logic in verification of Charities

modey

Summary

Registered charities can receive donations without being verified by the registry.

Vulnerability Details

CharityRegistry::isVerified doesn't accurately determine if a charity has been veified for donations because it reads from the registerCharities mapping instead of verifiedcharities mapping. As such users can just register charities and still receive donations because the check will always return true.

Impact

Unverified charities can receive donations which breaks protocol invariant.

Tools Used

Manual

Recommendations

change the isVerified function to this :

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.