RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No check if `goal` is reached in `withdraw`

saneryee

Summary

The withdraw function allows the fund creator to withdraw all raised funds without verifying if the funding goal has been reached.

Vulnerability Details

The withdraw function allows the fund creator to withdraw all funds at any time.

The function lacks any checks to verify:

  1. If the funding goal has been reached ( fund.amount_raised >= fund.goal )

  2. If the deadline has passed (for time-bound campaigns)

  3. If the campaign is in a valid state for withdrawal

This means a fund creator can create a campaign with a high goal, collect some contributions, and then withdraw all funds immediately without fulfilling the promised goal.

Impact

Users lose trust in the platform.

Tools Used

Recommendations

  1. Add goal verification

if fund.amount_raised < fund.goal {
return Err(ErrorCode::FundingGoalNotReached.into());
}
Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

No deadline check in `withdraw` function

No goal achievement check in `withdraw` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.