Submission Details
Severity:
Refunds Do Not Check Goal
Summary
The refund function checks only that the campaign’s deadline has passed. It does not verify whether the goal was met, meaning contributors can get refunds even from successful campaigns.
Vulnerability Details
pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
...
}
Impact
A successful campaign that raised sufficient funds may lose them to refunds, preventing the creator from using the funds as intended.
Tools Used
N/A
Recommendations
Add a check to ensure refunds are only allowed when the campaign fails
require!(fund.amount_raised < fund.goal, ErrorCode::GoalReached);
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.