Lack of Input Validation in fund_create function
Summary:
Hi,
I have found out a potential bug in which there's lack of input validation in fund_create function in the smart contract.
Vulnerability Details:
The key details of the vulnerability are given as follows:
The fund_create function does not validate that the goal is greater than zero. A goal of zero is meaningless in a crowdfunding context and could lead to unexpected behavior (e.g., allowing withdrawals without raising any funds).
Impact:
Users might create invalid campaigns, leading to confusion or exploitation.
Tools Used:
Manual review
Recommendations:
Ensure checking goal is greater than 0 and set some value range to check if goal is neither too short or too large.
Appeal created
No minimal amount for the `goal` in `fund_create` is greater than 0
If the `goal` is 0, the campaign goal is achieved immediately and the creator can withdraw the contributors funds. The contributors select themself which campaign to support, therefore I think Low severity is appropriate here.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.