RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `amount_raised` Update on Refund

abduo_ov

Description

The refund function resets the contributor’s contribution.amount to 0 but does not reduce the fund’s amount_raised by the refunded amount. This results in incorrect tracking of the total funds raised, making the protocol believe the fund has more SOL than it actually holds.

Impact

  • Incorrect Fund Accounting: The amount_raised value becomes inflated, misleading contributors and creators about the fund’s progress.

  • Operational Risks: Creators might withdraw more funds than available, or contributors could be denied refunds due to insufficient SOL in the fund.

Affected Code

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
​
// Refund logic...
ctx.accounts.contribution.amount = 0;
​
// MISSING: Update fund.amount_raised
Ok(())
}

Recommendation

Subtract the refunded amount from fund.amount_raised using checked_sub to prevent underflow:

fund.amount_raised = fund.amount_raised
.checked_sub(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Updates

Appeal created

bube Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`amount_raised` not updated in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.