Submission Details
Severity:
Creators can withdraw funds at anytime, even before the goal is reached
Summary
The creator of the fund can withdraw money at anytime. Wheter it is before the deadline or if the goal was reached.
Vulnerability Details
The withdrawfunction https://github.com/CodeHawks-Contests/2025-03-rustfund/blob/main/programs/rustfund/src/lib.rs#L90 ds
Impact
This goes against the rules of the fundraising campaing. Fund creators can rekt users at anytime.
Tools Used
Manual review
Recommendations
Implement a check in the withdraw function
// pseudo code
if accounts.fund.amount_raised < accounts.fund.goal {
return Err("Goal not reached")
}
if current_timestamp < accounts.fund.deadline {
return Err(ErrorCode::DeadlineNotReached.into());
}
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.