RustFund

Summary

The FundContribute struct lacks necessary ownership and PDA validation, allowing attackers to substitute arbitrary accounts. Since Solana’s Anchor framework relies on account constraints to enforce security, missing constraints create a critical vulnerability, enabling fund redirection.

Vulnerability Details

1. Ownership Check Missing:

   • The fund account does not enforce that it is owned by the program (has_one = creator), which allows an attacker to substitute any arbitrary account in place of the intended fund.

   • This opens the door for unauthorized access and account substitution attacks , where an attacker could redirect contributions to a malicious fund.

2. PDA Validation Missing:

   • The fund account does not validate its derivation as a PDA using the appropriate seeds (e.g., [b"fund", fund.creator.as_ref()]).

   • Without PDA validation, an attacker could pass an arbitrary account that satisfies the Account<'info, Fund> type but is not the correct PDA-derived fund.

Impact

1. Unauthorized Fund Manipulation:
   Attackers can pass arbitrary accounts for fund, bypassing crowdfunding-specific rules.

2. Account Takeover:
   Attackers can manipulate contributions of other users by passing incorrect contribution accounts.

3. Trust & Security Violation:
   Contributors may lose funds due to malicious manipulation of accounts, undermining the platform’s guarantees of transparency and security.

Proof of Concept

The following PoC demonstrates how an attacker can substitute an unauthorized fund PDA and redirect contributions. By using Pubkey::find_program_address with an arbitrary seed, the attacker generates a fake PDA and bypasses validation.

Recommendations

Option One: Anchor Constraints

Update the FundContribute struct as follows:

Option Two: Explicit Checks in Function Body: