GivingThanks

Summary

The donate() function sends Ether to a specified charity address using a low-level call. If the recipient contract (the charity) has a fallback function that initiates a recursive call back to donate(), it could repeatedly drain the contract's Ether before the function completes.

Impact

A reentrancy attack could result in the theft of Ether from the contract if the logic of donate() can be recursively executed before the state is updated.

Tools Used

manual

Recommendations

• Use the Checks-Effects-Interactions Pattern

• Add the ReentrancyGuard Modifier

  function donate(address charity) public payable nonReentrant {

  require(registry.isVerified(charity), "Charity not verified");

  ​

  // Mint the token before sending Ether (state change first)

  _mint(msg.sender, tokenCounter);

  string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);

  _setTokenURI(tokenCounter, uri);

  tokenCounter += 1;

  ​

  // Transfer Ether to the charity

  (bool sent, ) = charity.call{value: msg.value}("");

  require(sent, "Failed to send Ether");

  }