Submission Details
Severity:
Fund creation does not validate data
Summary
The campaing creator can create a fund with a goal of 0
Vulnerability Details
The function https://github.com/CodeHawks-Contests/2025-03-rustfund/blob/main/programs/rustfund/src/lib.rs#L12 does not check if the goal is > 0.
Impact
A campaign with 0 goal is useless.
Tools Used
Manual review.
Recommendations
Check for goal > 0 when creating a campaign.
Updates
Appeal created
bube 6 months ago
Submission Judgement Published Assigned finding tags:
No minimal amount for the `goal` in `fund_create` is greater than 0
If the `goal` is 0, the campaign goal is achieved immediately and the creator can withdraw the contributors funds. The contributors select themself which campaign to support, therefore I think Low severity is appropriate here.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.