Submission Details
Severity:
Refund allowed even if goal is already achieved.
Summary
The refund function allows contributors to withdraw funds even if the fundraising goal has already been reached.
Vulnerability Details
The function only checks if the deadline has passed but does not verify whether the goal was met. This can lead to situations where contributors withdraw funds from a successful campaign, potentially causing financial losses.
Impact
High. If the funding goal is reached, withdrawals could reduce the total raised, making the campaign ineffective.
Tools Used
Manual.
Recommendations
Add a check to prevent refunds if the funding goal has been met:
if ctx.accounts.fund.amount_raised >= ctx.accounts.fund.goal {
return Err(ErrorCode::FundingGoalReached.into());
}
Updates
Appeal created
bube 8 months ago
Submission Judgement Published Assigned finding tags:
There is no check for goal achievement in `refund` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.