RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Goal Check in Refund Logic

albert

Summary

The refund function allows contributors to claim refunds based solely on the deadline being reached, without checking if the funding goal was unmet.

Vulnerability Details

The current implementation only checks if the deadline has passed but doesn't verify if the campaign failed to meet its goal (amount_raised < goal). This allows unnecessary refunds even for successful campaigns.

Impact

Contributors could improperly withdraw funds from successful campaigns, reducing the creator's available funds and breaking campaign success incentives.

Tools Used

Manual code review

Recommendations

Modify the refund condition to include goal verification:

if fund.amount_raised >= fund.goal {
return Err(ErrorCode::GoalMet.into());
}
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

There is no check for goal achievement in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.