RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contribution Amount Not Updated in Contribution Account

vibhakarvaddi

Summary

When a user contributes to a fund, the contribution amount is not recorded in their Contribution account.

Vulnerability Details

In the contribute function:

if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}

  • The contribution.amount is initialized but never updated after transferring SOL.

  • The contributed amount should be recorded in the Contribution account for accurate tracking.

Impact

  • Incorrect tracking of contributions.

  • Users cannot verify their total contributions to a fund.

  • Refund logic may fail if contribution records are incorrect.

Tools Used

  • Manual code review

Recommendations

Update the contribute function to include:

contribution.amount += amount;

This ensures the contribution is recorded correctly.

Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.