Summary

The contribute function makes an external call to transfer funds and then modifies the status of the contract. Because of this, there is a chance that an attacker will repeatedly call contribute before the state update, which could result in them taking out more money than they had planned.

Vulnerability Details

There is a potential for reentrancy attacks caused by the contribute function which allows external calls before updating the contract's state.

Impact

By repeatedly calling the contribute function before the state is updated, an attacker could take advantage of this and accumulate funds without authorization.

Tools Used

Recommendations

1. Update state before external calls.

2. To stop sensitive functions from being executed repeatedly at the same time, implement a reentrancy guard mechanism.

   pub fn contribute(ctx: Context<Contribute>, amount: u64) -> ProgramResult {

   let campaign = &mut ctx.accounts.campaign;

   let contributor = &mut ctx.accounts.contributor;

   ​

   // Update state before making the external call

   campaign.total_amount += amount;

   contributor.amount_contributed += amount;

   ​

   // External call

   invoke(

   &system_instruction::transfer(

   &ctx.accounts.user.key,

   &campaign.key(),

   amount,

   ),

   &[

   ctx.accounts.user.to_account_info(),

   campaign.to_account_info(),

   ctx.accounts.system_program.to_account_info(),

   ],

   )?;

   ​

   Ok(())

   }

   ​