Submission Details
Severity:
Fund amount raise incorrect check
Summary
fund.amount_raised is not updated after the logic in refund is executed
Vulnerability Details
In the refund function, after the logic is executed, the contribution.amount has a hard reset to zero, but there is no logic ensuring the refunded sol is reflected in the fund.amount_raised.
Impact
This could lead to incorrect fund price updating when fund.amount_raised could be used for future logic like getting the price history of a fund to use for data archiving collections or just fund distribution
Tools Used
Manual review
Recommendations
use crate::error::ErrorCode;
use crate::state::{Contribution, Fund};
use anchor_lang::prelude::*;
pub fn _refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
//CHECK FOR FUND AMOUNT RAISED AND FUND GOAL
let fund = &mut ctx.accounts.fund;
// DEADLINE HAS TO BE LESS THAN CURRENT TIMESTAMP TO ENSURE THAT THE TIME IS ENDED
if ctx.accounts.fund.deadline != 0
&& ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap()
{
return Err(ErrorCode::DeadlineNotReached.into());
}
**ctx
.accounts
.fund
.to_account_info()
.try_borrow_mut_lamports()? = ctx
.accounts
.fund
.to_account_info()
.lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
**ctx
.accounts
.contributor
.to_account_info()
.try_borrow_mut_lamports()? = ctx
.accounts
.contributor
.to_account_info()
.lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
//CHECK FUND AMOUNT_RAISED STATE IS UPDATED EACH TIME THE IX IS CARRIED OUT
//THIS IS THE LOGIC WE WILL MAKE USE OF TO UPDATE THE ACCOUNT
fund.amount_raised -= ctx.accounts.contribution.amount;
// Reset contribution amount after refund
ctx.accounts.contribution.amount = 0;
ctx.accounts.contribution.reload()?;
Ok(())
}
Updates
Appeal created
bube 8 months ago
Submission Judgement Published Assigned finding tags:
`amount_raised` not updated in `refund` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.