Submission Details
Severity:
No Check for Contribution Existence in refund Function
Summary
The refund function does not check if the contribution account exists or if the contributor has actually contributed to the fund. This could allow malicious users to attempt refunds from non-existent or unrelated contributions.
Vulnerability Details
The refund function does not validate the existence of the contribution account:
pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
// No check for contribution existence
}
Impact
user could attempt to refund from a non-existent or unrelated contribution, potentially disrupting the contract's state.
Tools Used
manual review
Recommendations
Add a check to ensure the contribution account exists and is associated with the fund:
if ctx.accounts.contribution.amount == 0 {
return Err(ErrorCode::NoContributionFound.into());
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.