Submission Details
Severity:
Anyone can call withdraw in `pb fun withdraw`
Summary
The withdraw function does not check whether the caller is the fund's owner. This means anyone can trigger a withdrawal, allowing unauthorized users to drain the contract's funds.
Vulnerability Details
missing check in withdraw to verify that the person withdrawing is fund owner.
Impact
High
Tools Used
Manual review
Recommendations
Add an ownership check to verify that only the fund creator can withdraw:
if ctx.accounts.owner.key() != ctx.accounts.fund.owner {
return Err(ErrorCode::UnauthorizedWithdrawal.into());
}
Updates
Appeal created
bube 8 months ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
[Invalid] Lack of access control in `withdraw` function
There are enough security checks in `withdraw` function. Anchor enforces that creator must sign the transaction. And the `has_one = creator` ensures that the fund’s creator matches the provided creator account.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.