GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Any one can update the Registry contract address

ssalaudeen10

Summary

The Registry contract address can be updated by anyone. An attacker can create their own registry contract and update the GivingThanks contract to route all donations to their own account.

Vulnerability Details

Bug below:

function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}

Solution

modifier onlyOwner() {
if (msg.sender != owner) {
revert("Only Ownner can call this function");
}
_;
}
​
function updateRegistry(address _registry) public onlyOwner {
registry = CharityRegistry(_registry);
}

Impact

Allowing unauthorized users to update the Registry contract address can lead to the loss of funds.

Tools Used

Foundry Test

Recommendations

The contract should make use of the OpenZeppelin Ownable contract to restrict access to critical functions.

Consider adding unit tests to verify that only the owner can update the registry address and that the update process works as intended.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.