RustFund

First Flight #36
Beginner FriendlyRust
100 EXP
View results
Submission Details
Severity: high
Valid

Contributor's amount is not updated after in contribute()

Summary

The contribution function fails to update the individual contributor's contribution amount, preventing accurate tracking and potential withdrawal of contributed funds.

system_program::transfer(cpi_context, amount)?;
fund.amount_raised += amount;
// contribution.amount is not updated

Vulnerability Details

When a contribution is made, the total fund amount is incremented, but the specific contributor's contribution record remains unchanged. This breaks the core mechanism of tracking individual contributions.

Impact

This creates an inconsistencies between total raised funds and individual contributor records

Tools Used

Manual

Recommendations

Ensure the contributor's individual contribution amount is properly incremented during the transfer process, maintaining consistency between fund tracking and individual contributions.

+ contribution.amount += amount;
fund.amount_raised += amount;
Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.