RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Goal Check in refund() Allows Premature refunds

ashishlach

Summary

The refund() function allows the fund contributors to get refund of the funds eventhough goals have been met. This is due to check present in this function which will revert if fund goals are accomplished.

Vulnerability Details

Currently, the function simply refudns the contributed funds to the contributers.

However, there is no check to verify if fund.goal > fund.amount_raised. This means the creator can get the refunds, even if the fundraising goal has been met

https://github.com/CodeHawks-Contests/2025-03-rustfund/blob/b5dd7b0ec01471667ae3a02520701aae405ac857/programs/rustfund/src/lib.rs#L90

Impact

Fund contributors can refund even though fund goals are acheived

Tools Used

Manual Review

Recommendations

Add a check before allowing refund:

if ctx.accounts.fund.goal <= ctx.accounts.fund.amount_raised
{
return Err(ErrorCode::GoalReached.into());
}

This ensures that refunds are only possible if the goal is not reached, maintaining the integrity of the fundraising process.

Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

There is no check for goal achievement in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.