RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contribution Amount Not Updated in Contribution Account

0xnas

Summary

The function allows contributors to send SOL to a campaign, but it does not update the contribution.amount field after a successful transfer. This means the contribution record does not correctly reflect how much the user has contributed.

Vulnerability Details

  • The function initializes a Contribution account if it does not exist.

  • However, after transferring SOL, the contribution.amount field is not updated.

  • As a result, during a refund, users might not receive the correct amount they contributed.

Impact

  • Users who contribute SOL will have an incorrect balance stored in their contribution account.

  • The refund process may fail or return incorrect amounts.

  • This can cause financial loss or a broken refund mechanism.

Tools Used

Manual code review.

Recommendations

Ensure that contribution.amount is updated after the SOL transfer:

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
​
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
​
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
​
// Transfer SOL from contributor to fund account
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
​
// ✅ FIX: Update contribution amount
contribution.amount += amount;
fund.amount_raised += amount;
​
Ok(())
}
​
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.