RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No amount incrementation for users who already contributed earlier, leds to no change in the amount field of `contribution`

fairytales

Summary

The contribution function does not have any mechanism which checks if an user has already contributed before; which leds to amount field in the contribution staying as zero.

Vulnerability Details

The contribute instruction has a method to check if an user hasn't contributed before; if he hasn't made a contribution before it sets the contribution struct fields. But, there is no mechanism to increment the amount field, if the user wants to contribute once again; this will cause a loss to user if he requests a refund.

Impact

Loss to the user if he requests a refund.

Recommendations

Make change to contribute function:

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
..
...
+if contribution.contributor == ctx.accounts.contributor.key(){
​
+contribution.amount+=amount;
​
+}
​
...
​
...
​
}
Updates

Lead Judging Commences

bube Lead Judge
5 months ago

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.