Submission Details
Severity:
Missing Goal Check in Withdraw Function
Summary: The creator can withdraw funds regardless of whether the funding goal was met or the deadline has passed
Vulnerability Details: The withdraw function allows the creator to withdraw all raised funds at any time without checking if:
The funding goal was met
The deadline has been reached
Impact: Creators can take all the money raised anytime, even if the campaign hasn't reached its goal or deadline. This completely undermines the crowdfunding concept where funds should only be released under specific conditions.
Tools Used
Recommendations:
pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
let fund = &ctx.accounts.fund;
// Check if deadline has passed
let current_time: u64 = Clock::get().unwrap().unix_timestamp.try_into().unwrap();
if fund.deadline == 0 || current_time < fund.deadline {
return Err(ErrorCode::DeadlineNotReached.into());
}
// Check if goal was met
if fund.amount_raised < fund.goal {
return Err(ErrorCode::FundingGoalNotMet.into());
}
let amount = fund.amount_raised;
// Rest of the withdraw logic...
}
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Assigned finding tags:
No deadline check in `withdraw` function
No goal achievement check in `withdraw` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.