RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing Contribution Ownership Validation

0xnas

Summary

The function does not verify whether the contributor requesting a refund is the actual contributor recorded in the Contribution account. This opens up the possibility of unauthorized users claiming refunds.

Vulnerability Details

  • The function allows any user to call refund, without verifying if the caller matches the stored contributor.

  • A malicious user could use another contributor’s Contribution account to claim a refund on their behalf.

Impact

  • Unauthorized withdrawals can lead to fund leakage and loss of funds for legitimate contributors.

  • Attackers could systematically drain funds from the contract by exploiting this flaw.

Recommendations

Add a check to ensure that only the original contributor can request a refund:

if ctx.accounts.contributor.key() != ctx.accounts.contribution.contributor {
return Err(ErrorCode::UnauthorizedContributor.into());
}
​
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.