RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

amount_raised is not updated in withdraw() and refund()

chrissavov

Summary

After performing successful withdrawals and refunds, the program does not update the fund's amount_raised confusing the state.

Vulnerability Details

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
**ctx.accounts.contributor.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.contributor.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
​
// Reset contribution amount after refund
ctx.accounts.contribution.amount = 0;
Ok(())
}
​
pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
let amount = ctx.accounts.fund.amount_raised;
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
//@audit the amount substracted is expected to be the amount in fund.amount_raised
**ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.creator.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Ok(())
}
}

Both functions remove some amount of SOL from the program to either the creator or the contributor. However, both functions fail to update the state of fund.amount_raised. Whenever tokens are removed from the program, the raised_amount will not reflect this change.

Impact

It confuses the state of the program and user will see overinflated information about the program.
Scenario

  1. Contributor gets a refund since the goal has not been reached (assuming it is coded properly - see other reports)

    • Lamports are removed from the program. amount_raised is not updated

  2. Goal is later met. Creator attempts to withdraw funds (assuming this is also coded properly - see other reports)

    • Program does not have enough lamports to cover the amount_raised shown by the Fund struct.

For these reasons I qualify this vulnerability as high.

Tools Used

Manual review.

Recommendations

Update the amount_raised in both withdraw() and refund() with the amount being removed from the program.

Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`amount_raised` is not reset to 0 in `withdraw` function

`amount_raised` not updated in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.