Summary

The contribute function updates the amount_raised field using unchecked arithmetic (+=), which can lead to integer overflow. This vulnerability could result in incorrect accounting of funds, potentially allowing malicious users to exploit the contract.

Vulnerability Details

In the contribute function, the amount_raised field is updated as follows:

This operation does not check for overflow, which can occur if amount_raised + amount exceeds the maximum value of a u64.

Impact

If an overflow occurs, the amount_raised field will wrap around to a small value, leading to incorrect accounting of funds.

Tools Used

manual review

Recommendations

Replace the unchecked arithmetic with checked_add to handle overflow safely: