RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contributors cannot get a refund.

vgcodes

Summary

contribute function is the lib.rs is used for the contribution of sol to the fund, this is usually called by the users.
How this should usually work,

  • Transfer the sol from the user contract to this contract

  • increase the fund.amount_raised

  • increase the contribution of the user.

    However it does not implement the later properly, there is no increment in contribution of the user, this can create problem in two front

  • Improper handling of the funds

  • The contributors are not able to refund the funds, if needed

The later seems more complication then the previous one, refund function is implemented as follows

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
**ctx.accounts.contributor.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.contributor.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
​
// Reset contribution amount after refund
ctx.accounts.contribution.amount = 0;
​
Ok(())
​
​

Here we can clearly see that the amount is equal to the ctx.accounts.contribution but because it was never incremented it will remain as the default value of 0 , the users cannot get a refund anymore.

Attack pattern

None

Mitigation

Incrementing the user contribution on contribution will likely fix this issue.

Updates

Appeal created

bube Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!