GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing remove verified charity function

dustinhuel2

Summary

The contract includes functionality for registering and verifying charity addresses but lacks a mechanism to remove or revoke the verification status of a charity. This can lead to situations where a previously verified charity that should no longer be trusted remains verified indefinitely.

Impact

If a verified charity's status changes (e.g., it becomes non-compliant or fraudulent), the contract admin has no way to update or revoke its verification. This could mislead users who rely on the isVerified() function for validation.

Tools Used

Manual review

Recommendations

Implement a function that allows the admin to remove the verification status of a charity. This function should include proper access control and event emission.

function revokeVerification(address charity) public {
require(msg.sender == admin, "Only admin can revoke verification");
require(verifiedCharities[charity], "Charity is not verified");
verifiedCharities[charity] = false;
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-no-removal-function-for-malicous-charity-updates

Likelyhood: Low/Medium, charities can process an upgrade including a new unverified codebase. Impact: High, a charity can upgrade with bad function and bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.