GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

when check if the charity is verified, only check if the charity is registered

zhanmingjing

Summary

when check if the charity is verified, only check if the charity is registered. A charity will be treated as verified just after it is registered, doesn't need the owner's verification.

Vulnerability Details

https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/CharityRegistry.sol#L24

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity];
}

Impact

A charity will be treated as verified just after it is registered, even if the owner doesn't verifyCharity.

Tools Used

forge and manually review

Recommendations

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.