Summary

Refunds are allowed after the deadline regardless of whether the funding goal was met, which might not align with the crowdfunding expectations.

Vulnerability Details

In the refund() function
Fund reaches its goal -> Deadline passes -> contributors still refund, leaving creator with less than the goal.

##Impact

Contributors can refund after deadline even if amount_raised >= goal

Undermines the purpose of a successful fund and leaves the creator with less contributions than the goal he intended.

Tools Used

Manual review

Recommendations

Add a check for unsuccessful funding.

require!(fund.deadline <= clock.unix_timestamp as u64, ErrorCode::DeadlineNotReached); require!(fund.amount_raised < fund.goal, ErrorCode::FundGoalMet);