RustFund

Summary

Inside the withdraw function, ctx.accounts.fund.amount_raised should be set to 0 after fund's SOL holdings are sent from the fund to fund's creator, but that is not done in withdraw function's implementation.

Vulnerability Details

Inside the withdraw function, ctx.accounts.fund.amount_raised should be set to 0 after fund's SOL holdings are sent from the fund to fund's creator, but that is not done in withdraw function's implementation.

Impact

Not setting ctx.accounts.fund.amount_raised to 0 after fund's SOL holdings are sent from the fund to fund's creator totally messes up fund's accounting information and fund.amount_raised no longer tracks correctly the SOL amount that is actually held inside the fund at any time. As fund.amount_raised is messed up, calling fuctions depending on fund.amount_raised may lead to inconsistent behaviour and unexpected function errors. The following scenario is possible:

1. Creator creates a fund

2. Contributors start contributing to that fund

3. Contribution campaign for the fund is over

4. Fund's creator withdraws the SOL from inside the fund

5. Fund's creator sets fund's deadline to some point in the future, making the contribution campaign active again

6. Contributors start contributing to that fund again

7. However, fund's amount_raised is no longer intact, because in step 4. the creator has withdrawn the SOL from the fund, but fund's amount_raised is not set to 0 inside the withdraw function.

8. Contribution campaign for the fund is over again

9. Fund's creator tries to withdraw the SOL from inside the fund, but fails, because ctx.accounts.fund.amount_raised is greater than the actual SOL holdings of the fund. Thus, trying to withdraw more SOL than what's actually inside the fund leads to an error. All creator calls to withdraw after fund.amount_raised is messed up, lead to an error in the withdraw function and fund's creator is not able to withdraw the fund's SOL. Thus, the SOL remains inside the fund forever.

Tools Used

Manual Review

Recommendations

Inside the withdraw function, set ctx.accounts.fund.amount_raised to 0 after fund's SOL is withdrawn from fund's creator.