GivingThanks

Summary:

The GivingThanks contract is vulnerable to Access Control Issues in the updateRegistry function, which can allow any user to change the address(charity registry) to a contract without restriction which could lead to unauthorized control or access over the donation process.

Vulnerability Details:

There is lack of proper access control in the updateRegistry function in the GivingThanks contract:

1. The function can be called by any user, since there is no onlyOwner or access control modifiers used.

2. An attacker can call updateRegistry and set the registry to their own contract address.

3. This malicious contract can then manipulate the outcome of the registry.isVerified(charity) check in the donate function to verify any given address falsely, then as a result, the attacker can direct donations to a false charity and completely withdraw the user funds.

Impact:

1. Attacker can withdraw users' donations to a different address resulting in financial loss.

2. Verification checks can be bypassed resulting to donation received by a different address.

Tools Used:

1. Manual review of code to identify access control issues and attacks.

2. Slither was used to detect access control issues.

Recommendations:

Introduce Access Control:

```