Submission Details
Severity:
Lamport Transfer Uses Direct Borrowing Instead of CPI Transfer
Summary
The function directly modifies lamports using:
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? = ...
While this works, CPI transfers are preferred for security and maintainability.
Impact
If there are other constraints or checks (e.g., rent exemption), directly modifying lamports can cause unintended behavior.
Recommendations
Use the invoke method to perform the SOL transfer securely:
invoke(
&system_instruction::transfer(
ctx.accounts.fund.to_account_info().key,
ctx.accounts.contributor.to_account_info().key,
amount,
),
&[
ctx.accounts.fund.to_account_info(),
ctx.accounts.contributor.to_account_info(),
ctx.accounts.system_program.to_account_info(),
],
)?;
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Assigned finding tags:
Unsafe direct lamport manipulation
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.