RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

No Check if Contribution Amount Exceeds Fundraising Goal in contribute function

0xblackadam

Summary

The contract allows contributions without verifying if the total raised amount would exceed the original fundraising goal.

Vulnerability Details

  • The contribute function does not check if adding the new amount would push amount_raised beyond goal.

  • This could result in a situation where a fund collects more than its intended goal without any enforcement mechanism.

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
​
//@audit No check if fund.amount_raised += amount > fund.goal
​
​
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
​
// Transfer SOL from contributor to fund account
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
fund.amount_raised += amount;
Ok(())
}

Impact

  • Overfunding can lead to misallocation of resources and unintended fund distribution issues.

  • Contributors might be unknowingly donating to a fully funded campaign.

Recommendations

  • Implement a check before accepting contributions to prevent exceeding the goal.

// Goal Exceedance Prevention
let potential_total = fund.amount_raised.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
if potential_total > fund.goal {
return Err(ErrorCode::GoalExceeded.into());
}
​
// Improved Contribution Tracking
contribution.amount = contribution.amount.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;

Tools Used

  • Code review

Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

[Invalid] The contributions are allowed even after the campaign's goal is reached

Typically the crowdfunding campaigns allow contribution after the goal is achieved. This is normal, because the goal is the campaign to raise as much as possible funds. Therefore, this is a design choice.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.