RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

PDA Seed Collision Risk

abduo_ov

Description

The Fund account PDA seeds (name.as_bytes() + creator.key().as_ref()) allow a single creator to create only one fund with the same name. If the protocol intends to allow multiple funds with the same name per creator, this seed design causes PDA collisions.

Impact

  • Failed Fund Creation: A creator cannot create multiple funds with the same name.

  • Protocol Limitations: Restricts flexibility if multiple funds per creator with identical names are desired.

Affected Code

​
// Line 140
#[account(init, seeds = [name.as_bytes(), creator.key().as_ref()], ...)]
pub fund: Account<'info, Fund>,

Recommendation

Add a unique nonce to the PDA seeds:

#[account(init,
seeds = [b"fund", creator.key().as_ref(), &fund.nonce.to_le_bytes()],
bump
)]
pub fund: Account<'info, Fund>,

  1. Add a nonce: u64 field to the Fund struct.

  2. Increment the nonce for each new fund created by the same creator.

Updates

Appeal created

bube Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.