RustFund

Summary

The withdraw function allows any authorized creator to withdraw the full amount_raised without checking whether the fundraising goal has been reached or whether the campaign has ended. This logic flaw can result in premature or unauthorized fund withdrawals, undermining the integrity of the crowdfunding platform.

Vulnerability Details

The withdraw() function lacks critical checks for:

• Whether the deadline has passed.

• Whether the goal has been reached.

• Marking the fund as withdrawn or resetting amount_raised after withdrawal.

Root Cause:

https://github.com/noob6t5/2025-03-rustfund/blob/b5dd7b0ec01471667ae3a02520701aae405ac857/programs/rustfund/src/lib.rs#L90

• The withdraw function has no check to ensure the fundraising deadline is reached or the goal is met.

• This allows the creator to withdraw funds at any time, including before deadline expiration or goal achievement.

Impact

A malicious fund creator can:

• Withdraw all funds at any time, even before the campaign deadline.

• Withdraw without meeting the funding goal.

• Potentially withdraw again if the fund is replenished since amount_raised isn’t reset.

Tools Used

Manual Code Review

Recommendations

1. Add checks in withdraw() to ensure fund.deadline has passed

2. After withdrawal, reset amount_raised to 0 or mark the fund as closed