RustFund

Summary

Direct lamports manipulation in withdraw and refund doesn't account for rent-exempt amounts.

Vulnerability Details

The current implementation transfers raw lamports equal to amount_raised, which could include:

1. Rent-exempt reserve in fund account

2. Any accidental additional deposits

Impact

1. Potential account closure if rent-exempt lamports are removed

2. Possibility of draining extra funds not from contributions

Tools Used

Manual code review

Recommendations

1. Track actual contributed amounts separately from account balances

2. Use proper CPI transfers instead of direct lamports manipulation

3. Add state field tracking withdrawable amount