RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of Creator Validation in withdraw Function

rare__one

Summary

The withdraw function does not validate whether the caller is the creator of the fund. This could allow a malicious user to withdraw all funds from any fund.

Vulnerability Details

The withdraw function does not check if the caller is the creator of the fund:

Impact

A malicious user could call withdraw and drain the funds from any fund, even if they are not the creator.

Tools Used

manual review

Recommendations

Add a check to ensure only the creator can withdraw funds:

if ctx.accounts.creator.key() != fund.creator {
return Err(ErrorCode::UnauthorizedAccess.into());
}
Updates

Appeal created

bube Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[Invalid] Lack of access control in `withdraw` function

There are enough security checks in `withdraw` function. Anchor enforces that creator must sign the transaction. And the `has_one = creator` ensures that the fund’s creator matches the provided creator account.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.