Summary

The registerCharity() function in the CharityRegistry contract lacks access control, allowing anyone to register any address as a charity without restriction.

Vulnerability Details

The registerCharity() function is publicly accessible and lacks an access control modifier, such as onlyAdmin. As a result, any external user can invoke this function to register any address, including their own, as a charity. This setup allows anyone to flood the registry with unauthorized or fake charities.

Here is the vulnerable function shown below:

Because registerCharity() is a public function with no access restrictions, any address can register as a charity. This issue is exacerbated by the fact that the GivingThanks contract relies on CharityRegistry to verify charities using the isVerified() function. However, the isVerified() function only checks if a charity is registered and doesn’t actually verify the charity’s legitimacy:

In the GivingThanks contract, the donate() function relies on registry.isVerified(charity) to check if the charity is valid before sending a donation. Since this check does not confirm that the charity is verified, it could allow funds to be directed to merely registered, unverified addresses.

Impact

• Enables arbitrary addresses to be added to the registeredCharities mapping, potentially flooding it with fake, malicious, or zero addresses.

• Weakens the integrity of the GivingThanks contract, allowing donations to go to unverified and potentially fraudulent charities by relying on the isVerified() check that only confirms registration, not verification.

Tools Used

Manual review of the CharityRegistry.sol contract.

Recommendations

Implement an onlyAdmin modifier to restrict the registerCharity() function to only be called by the admin. Here is how to implement it:

Also, the protocol can update the isVerified() function to return the actual verification status of the charity rather than just its registration status:

By implementing these changes, the protocol can ensure that only verified charities are registered and prevent donations from being misdirected to unauthorized addresses.