Submission Details
Severity:
Missing update on `fund.amount raised` in `pb fun refund` function
Summary
The function does not update fund.amount_raised when a refund is processed. This results in an inconsistent state, where the contract still reflects the original raised amount, even though funds have been withdrawn.
Vulnerability Details
fund.amount_raised is not updated in refund function.
Impact
The contract's state becomes inaccurate, affecting logic that depends on amount_raised.
Tools Used
Manual
Recommendations
Update fund.amount_raised to accurately reflect refunds:
ctx.accounts.fund.amount_raised = ctx.accounts.fund.amount_raised.checked_sub(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Updates
Appeal created
bube 8 months ago
Submission Judgement Published Assigned finding tags:
`amount_raised` not updated in `refund` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.