Submission Details
Severity:
Anyone can call refund in ` pb fun refund `
Summary
The function lacks an ownership check, allowing anyone to call refund on behalf of a contributor. Without verifying that the refund is being requested by the original contributor, an attacker could steal someone else's refund.
Vulnerability Details
A malicious user can call the refund function and get a refund on behalf of another contributor. The function does not check if ctx.accounts.contributor.key() matches ctx.accounts.contribution.contributor
Impact
Users can lose their refund if attacker claims it first.
Tools Used
Manual
Recommendations
Ensure that only the original contributor can claim their refund:
if ctx.accounts.contributor.key() != ctx.accounts.contribution.contributor {
return Err(ErrorCode::UnauthorizedRefund.into());
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.