Submission Details
Severity:
Lack of remove charity can leads to donation loss
Summary
There's no remove charity's verified role in the CharityRegistry contract. So if admin detect a malicious donor, it couldn't be remove his verification.
Impact
Verified malicious user can receive donation permanently.
Tools Used
manual
Recommendations
Add removeCharity() function to remove malicious donor.
function removeCharity(address charity) public {
require(msg.sender == admin, "Only admin can verify");
require(verifiedCharities[charity], "Charity not verified");
verifiedCharities[charity] = false;
}
Updates
Lead Judging Commences
n0kto 7 months ago
Submission Judgement Published Assigned finding tags:
finding-no-removal-function-for-malicous-charity-updates
Likelyhood: Low/Medium, charities can process an upgrade including a new unverified codebase. Impact: High, a charity can upgrade with bad function and bypass the verification process
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.