RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Goal Check in refund Function

vibhakarvaddi

Summary
The refund function allows contributors to refund their contribution even if the fundraising goal has already been reached.

Vulnerability Details
In the refund function:

  • The function only checks if the deadline has passed before allowing a refund.

  • There is no check to prevent refunds if the goal has been met before the deadline.

Impact

  • Contributors can withdraw funds even after a successful fundraiser, which may result in an improper reduction of the fund’s balance.

  • This could allow a potential exploit where users contribute, wait for the goal to be reached, and then refund while funds are still being used.

Tools Used

  • Manual code review

Recommendations
Before allowing a refund, add a validation check:

if ctx.accounts.fund.amount_raised >= ctx.accounts.fund.goal {
return Err(ErrorCode::GoalReached.into());
}

This ensures that refunds are only allowed when the goal is not yet met.

Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

There is no check for goal achievement in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.