Submission Details
Severity:
No Funding Goal Check in Refunds (Denial of Service on Campaign Creator)
Summary
Refunds should only be allowed if the campaign fails (amount_raised < goal)
.Currently, contributors can claim refunds even if the campaign succeeds.
Vulnerability Details
The absence of a check to monitor if Funding Goal was reached makes it possible for contributors to claim a refund even when Funding Goal was reached.
Impact
Denial of Service (DoS) on Campaign Creator as they might not receive total funds if any contributor "invokes" refund despite campaign goal being reached.
Tools Used
1. Manual Review
Recommendations
Despite not being an avenue for a direct attack, logic flaw must be patched.
Fixing this ensures contributors cannot refund themselves after a campaign succeeds.
if ctx.accounts.fund.amount_raised >= ctx.accounts.fund.goal {
return Err(ErrorCode::CampaignSucceededNoRefund.into());
}
Updates
Appeal created
bube 6 months ago
Submission Judgement Published Assigned finding tags:
There is no check for goal achievement in `refund` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.