RustFund

First Flight #36
Beginner FriendlyRust
100 EXP
View results
Submission Details
Severity: medium
Invalid

No checks on creator/owner in the fund_create function

Summary

Not enough checks on the creator account stored in the Fund struct account.

Vulnerability Details

In the fund_create function , after the fund.creator has been initilialized and been made to be the ctx.creator.key(), there is no explicit check to properly confirm the creator stored in the Fund account is truly the one who initlialized the function.

Impact

This can lead to incorrect data if not specified or checked well which. If creators are to be rewarded in some way, the funds will not reach them, if the Fund account details are used explicitly.

Tools Used

Manual review alongside anchor test

Recommendations

make use of require!(fund.creator == ctx.accounts.creator.key(), IncorrectSigner) in the fund_create function.
IncorrectSigner being a custom error under the error_code enum.

Updates

Lead Judging Commences

bube Lead Judge
3 months ago

Appeal created

bube Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.