RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Refunds Blocked After Deadline

willubedaone

Summary

The refund function prevents contributors from reclaiming their funds if a campaign fails but the deadline has been reached. This conflicts with the documentation, which states:

"Contributors can get refunds if deadlines are reached and goals aren't met."

Vulnerability Details

Currently, the refund function only checks whether the deadline has been reached but does not check if the goal has been met. If the goal is met, refunds should not be allowed. However, if the goal is not met, contributors should still be able to get their funds back.

Proof of Concept

  1. A creator sets up a campaign with a goal of 100 SOL and a deadline.

  2. Contributors donate a total of 30 SOL before the deadline.

  3. The deadline passes, but the goal was not met.

  4. A contributor attempts to call refund() but is blocked because the function does not verify whether the goal was actually met.

The Impact Code

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0
&& ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
​
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
​
**ctx.accounts.contributor.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.contributor.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
ctx.accounts.contribution.amount = 0;
Ok(())
}
​

Impact

  • Contributors cannot get refunds even if the campaign fails (i.e., does not meet the goal).

  • Funds remain locked, preventing contributors from reclaiming them.

  • This contradicts the documentation, which states that contributors can request refunds if the goal is not met and the deadline is reached.

Tools Used

Manual code review

Recommendations

Modify the refund function to ensure contributors can receive a refund if the goal was not met after the deadline:

if fund.amount_raised >= fund.goal {
return Err(ErrorCode::GoalMet.into()); // Refunds should not be allowed if the goal is met
}
if fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
​
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

There is no check for goal achievement in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.