RustFund

Summary

Inside the withdraw function no SOL transfer via the system_program is performed, thus fund's creator cannot take the SOL contributed to his fund.

Vulnerability Details

Inside the withdraw function no SOL transfer via the system_program is performed, thus fund's creator cannot take the SOL contributed to his fund and all the SOL remains stuck inside the fund forever.

Impact

SOL tokens remain stuck inside the fund, because fund's creator is not able to take them from the fund as there is no SOL transfer via the system_program.

Tools Used

Manual Review

Recommendations

Inside the withdraw function, initiate an explicit system_program SOL transfer from the fund to fund's creator, because the system_program is the one that is responsible for handling SOL transfers.