RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Denial of Service (DoS) – Unlimited Fund Creation

bsac

Summary

There is no limit on the number of funds a user can create, making the contract vulnerable to spam fund creation. This can overload blockchain storage, increase fees, and slow down transactions.

Vulnerability Details

Vulnerable Code:

#[derive(Accounts)]
pub struct FundCreate<'info> {
#[account(init, payer = creator, space = 8 + Fund::INIT_SPACE, seeds = [name.as_bytes(),creator.key().as_ref()], bump)]
pub fund: Account<'info, Fund>,
#[account(mut)]
pub creator: Signer<'info>,
pub system_program: Program<'info, System>,
}
​

Issue:

  • No restriction on how many funds a user can create.

  • Attackers can create thousands of funds, clogging up blockchain storage.

Impact

Higher Solana fees due to excessive state storage.

  • Legitimate users may experience transaction delays.

  • Scammers can flood the platform with fake funds, reducing trust in the system.

Tools Used

Manually

Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.