RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized Fund Withdrawal via unprotected withdraw() function

smarrt

Summary

The withdraw function allows any authorized creator to withdraw the full amount_raised without checking whether the fundraising goal has been reached or whether the campaign has ended. This logic flaw can result in premature or unauthorized fund withdrawals, undermining the integrity of the crowdfunding platform.

Vulnerability Details

The withdraw() function lacks critical checks for:

  • Whether the deadline has passed.

  • Whether the goal has been reached.

  • Marking the fund as withdrawn or resetting amount_raised after withdrawal.

Root Cause:

https://github.com/noob6t5/2025-03-rustfund/blob/b5dd7b0ec01471667ae3a02520701aae405ac857/programs/rustfund/src/lib.rs#L90

  • The withdraw function has no check to ensure the fundraising deadline is reached or the goal is met.

  • This allows the creator to withdraw funds at any time, including before deadline expiration or goal achievement.

pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
// ❌ Missing: SOmething like this
// if fund.deadline != 0 && fund.deadline > current_time { return Err(...); }
​
let amount = ctx.accounts.fund.amount_raised;
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
**ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.creator.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Ok(())
}

Impact

A malicious fund creator can:

  • Withdraw all funds at any time, even before the campaign deadline.

  • Withdraw without meeting the funding goal.

  • Potentially withdraw again if the fund is replenished since amount_raised isn’t reset.

Tools Used

Manual Code Review

Recommendations

  1. Add checks in withdraw() to ensure fund.deadline has passed

  2. After withdrawal, reset amount_raised to 0 or mark the fund as closed

Updates

Appeal created

bube Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

No deadline check in `withdraw` function

No goal achievement check in `withdraw` function

`amount_raised` is not reset to 0 in `withdraw` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.