RustFund

Summary

The withdraw function lacks checks for deadline or goal completion, allowing the creator to withdraw all raised funds immediately after creation.

Vulnerability Details

The withdraw function transfers amount_raised to the creator without validating if the fundraising goal was met or if the deadline has passed. This enables premature and unauthorized fund drainage.

https://github.com/CodeHawks-Contests/2025-03-rustfund/blob/b5dd7b0ec01471667ae3a02520701aae405ac857/programs/rustfund/src/lib.rs#L90-L106

Impact

Creators can maliciously withdraw funds before the campaign ends, breaking trust and causing financial loss for contributors.

Tools Used

Recommendations

Add checks to ensure withdrawals only occur after the deadline and if the goal is met.