RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`amount_raised` not updated after refund leads to incorrect withdrawal amount

0xharry

Summary

The refund function does not subtract the refunded amount from fund.amount_raised, which causes the withdraw function to compute an inaccurate withdrawal amount.

Vulnerability Details

When a user requests a refund, the refunded amount is transferred back to them correctly. However, the amount_raised field is not updated.

Later, when the creator calls withdraw, it calculates the amount to withdraw as:

pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
@> let amount = ctx.accounts.fund.amount_raised;
...
}

This amount will include refunded contributions, which no longer exist in the actual fund account balance. As a result, the creator ends up withdrawing less than they actually could, or worse — the withdrawal could fail if the recorded amount is higher than the real lamports in the fund.

Impact

Creators might get less money than they should, or the withdraw might even fail if the fund balance doesn’t match what’s recorded. This makes the fund data unreliable and can break how other parts of the app work or confuse users.

Even though the numbers are wrong, no one can actually steal or lose money because of this. It doesn’t give any unfair benefit to attackers. That’s why this issue is considered Medium severity.

Tools Used

Manual review

Recommendations

Update the refund function to subtract the refunded amount from amount_raised:

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
​
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
​
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
​
**ctx.accounts.contributor.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.contributor.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
+ ctx.accounts.fund.amount_raised -= amount;
​
// Reset contribution amount after refund
ctx.accounts.contribution.amount = 0;
​
Ok(())
}
​
Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`amount_raised` not updated in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.