RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contribution Tracking Issue

sbenarjee7

Summary

The contribute function in the RustFund program fails to update the contribution.amount field in the Contribution account, resulting in incorrect tracking of individual contributions. While fund.amount_raised is correctly incremented, the contribution.amount remains unchanged (typically 0), rendering the refund mechanism ineffective as it relies on this value to determine the refund amount.

Vulnerability Details

In the contribute function:

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
fund.amount_raised += amount; // Updates total raised
// Missing: contribution.amount += amount; // Individual contribution not tracked
Ok(())
}

  • The fund.amount_raised is incremented by the contributed amount.

  • However, contribution.amount is not updated after the transfer, remaining at its initial value (0 if newly initialized).

  • The refund function uses let amount = ctx.accounts.contribution.amount, which will always be 0, meaning no funds are actually refunded despite the transfer occurring.

Impact

  • Loss of Functionality: Contributors cannot receive proper refunds because the contribution.amount is not tracked, breaking the refund mechanism.

  • Financial Risk: Contributors lose their ability to recover funds if the campaign fails, as the refund amount is always 0.

  • Trust Issue: Undermines the platform's reliability, as contributors expect their contributions to be tracked and refundable under the specified conditions (deadline passed, goal not met).

  • Data Inconsistency: The total fund.amount_raised reflects contributions, but individual contribution.amount records do not, leading to a mismatch in accounting.

Tools Used

Manual review

Recommendations

Modify the contribute function to update contribution.amount alongside fund.amount_raised

Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.