Submission Details
Severity:
`amount_raised` Not Reduced on Refund
Description
When a contributor requests a refund, the fund.amount_raised value is not reduced by the refunded amount. This results in an inflated total of raised funds, misrepresenting the actual balance held by the fund.
Impact
Inaccurate Accounting: The protocol will report a higher
amount_raisedthan the actual SOL held in the fund.Operational Risks: Creators may withdraw more funds than available, or contributors might be denied refunds due to insufficient SOL.
Affected Code
// Line 83
pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
// ...
ctx.accounts.contribution.amount = 0;
// MISSING: fund.amount_raised -= amount;
}
Recommendation
Use checked_sub to safely decrement amount_raised and handle underflow:
fund.amount_raised = fund.amount_raised
.checked_sub(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Updates
Appeal created
bube 3 months ago
Submission Judgement Published Assigned finding tags:
`amount_raised` not updated in `refund` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.