RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Integer Overflow in `fund.amount_raised`

abduo_ov

Description

The fund_contribute function updates fund.amount_raised using +=, which is vulnerable to integer overflow if the sum of amount_raised and amount exceeds the maximum u64 value.

Impact

  • Fund Accounting Corruption: Overflow could reset amount_raised to an incorrect value, making the protocol believe the fund’s goal was met prematurely or not at all.

  • Financial Loss: Contributors might receive incorrect refunds or rewards based on corrupted data.

Affected Code

// Line 58:
fund.amount_raised += amount; // Vulnerable to integer overflow

Recommendation

Replace += with checked_add to handle arithmetic safely and throw an error on overflow:

fund.amount_raised = fund.amount_raised
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Updates

Appeal created

bube Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Arithmetic overflow in `contribute` function

The max value of u64 is: 18,446,744,073,709,551,615 or around 18.4 billion SOL, given that the total supply of SOL on Solana is 512.50M, the scenario when the `contribute` function will revert due to overflow is very very unlikely to happen. Therefore, this is informational finding.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.