GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`isVerified()` of `CharityRegistry.sol` returns unverified charities

linmiaomiao

Summary

isVerified() of CharityRegistry.sol returns registeredCharities,anyone can just call registerCharity()to obtaining verified certification.

Vulnerability Details

isVerified() of CharityRegistry.sol returns registeredCharities :

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity];
}
​

anyone can just call registerCharity()to obtaining verified certification:

function registerCharity(address charity) public {
registeredCharities[charity] = true;
}

Impact

Since anyone can freely register as a charity, the charity permission check in the donate function becomes ineffective:

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
......
}

An attacker can register any address as a charity, perform a donation (even donating to themselves), and receive the corresponding issued ERC721 tokens.

Tools Used

foundry

Recommendations

fix code like this:

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.