RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`ctx.accounts.fund.amount_raised` is not updated inside the `refund` function

dethera

Summary

ctx.accounts.fund.amount_raised is not updated inside the refund function.

Vulnerability Details

ctx.accounts.fund.amount_raised is not updated inside the refund function. Because a contributor takes his contributions back from the fund, fund.amount_raised decreases, but this is not implemented inside the refund function.

Impact

By not updating the ctx.accounts.fund.amount_raised when a contributor takes his contributions from the fund, ctx.accounts.fund.amount_raised no longer tracks correctly the amount of SOL kept inside the fund at any given moment. Because ctx.accounts.fund.amount_raised is never decreased, once ctx.accounts.fund.amount_raised is messed up (by calling the refund function), ctx.accounts.fund.amount_raised is always greater than the actual SOL held inside the fund. When fund's creator tries to withdraw the SOL from the fund, the call to withdraw will error as the creator tries to withdraw ctx.accounts.fund.amount_raised, which is more than the SOL holdings of the fund. As a result, all the SOL remains stuck inside the fund forever.

Tools Used

Manual Review

Recommendations

Inside the refund function, decrease ctx.accounts.fund.amount_raised by amount, so that ctx.accounts.fund.amount_raised tracks correctly fund's holdings. The updated function should look like so:

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
​
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
​
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
​
**ctx.accounts.contributor.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.contributor.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
​
// Reset contribution amount after refund
ctx.accounts.contribution.amount = 0;
@> ctx.accounts.fund.amount_raised -= amount;
​
Ok(())
}
Updates

Appeal created

bube Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`amount_raised` not updated in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.