RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Not recording contributed amount in `rustfund::contribute` leads to broken refund logic

0xharry

Summary

The contribute function does not store the actual contributed amount in the contributor’s Contribution account. This causes the refund logic to malfunction later on, as it relies on this recorded amount.

Vulnerability Details

When users call the contribute function, their lamports are correctly transferred to the fund. However, the amount is not recorded in their corresponding Contribution account.

As a result, when refund is called later, the amount retrieved from ctx.accounts.contribution.amount is zero:

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
@> let amount = ctx.accounts.contribution.amount;
...
}

Impact

Refunds will silently fail because the contract believes the user contributed nothing. This could cause loss of funds for users and undermine the integrity of the protocol.

Tools Used

Manual review

Recommendations

Update the contribute function to correctly track the amount contributed per user:

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
​
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
​
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
​
// Transfer SOL from contributor to fund account
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
​
fund.amount_raised += amount;
@> contribution.amount += amount;
​
Ok(())
}
Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.