RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

No Verification of Fund Balance Before Withdrawal

0xnas

Summary

The function attempts to withdraw the entire fund balance without verifying if sufficient lamports exist, leading to potential errors.

Vulnerability Details

  • If the fund balance is insufficient, the subtraction will fail.

  • There is no check to confirm that the contract has enough lamports before performing the withdrawal.

Impact

  • Potential denial of service (DoS) if withdrawal attempts fail.

  • Unpredictable behavior and errors if the fund balance is inconsistent.

Tools Used

  • Manual Code Review

  • Runtime Testing

Recommendations

Before attempting withdrawal, validate the fund balance:

if ctx.accounts.fund.to_account_info().lamports() < amount {
return Err(ProgramError::InsufficientFunds.into());
}
​
Updates

Lead Judging Commences

bube Lead Judge
5 months ago

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.