GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect check of if charity address is verified

ssalaudeen10

Summary

The view function isVerified returns a boolean indicating if an address is registered, thereby making all registered charity addresses eligible to accept donations.

Vulnerability Details

Bug below:

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity];
}

Solution

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}

Impact

A malicious address could be marked as verified and able to accept donations when checked in the GivingThanks contract.

Tools Used

Foundry Test

Recommendations

Update the isVerified function to return from the correct mapping, verifiedCharities:

solidity

mapping(address => bool) public verifiedCharities;
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.