Double refund. Re-entrancy
Summary
Contributors can do multiple withdrawals of same contribution
Vulnerability Details
The function resets contribution.amount to 0 but doesn’t prevent re-entrancy or multiple refund attempts if the transaction fails mid-execution.
Attacker could potentially call `refund()' multiple times if execution is interrupted after lamport transfer but before state update potentially draining the fund.
Impact
Refund executes, transfers lamports
Fails before contribution.amount = 0
Attacker re-calls refund()with original amount getting double refund.
Tools Used
Manual review
Recommendations
Move the state update before transfer or mark with a refunded flag.
Appeal created
[Invalid] Reentrancy in refund
The reentrancy risk on Solana is highly eliminated. The `try_borrow_mut_lamports` ensures that only one reference to an account exists at a time. Also, once the fund’s lamports are borrowed mutably, no other transaction can modify them until the borrow is released. This means the function will reset the `amount` before the next call.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.