Contribution amount not tracked in contribute function leads to incorrect contribution record
Summary
The contribute function fails to update contribution.amount with the contributed amount. It initializes to 0 for new contributions but never increments it, leaving the contribution record inaccurate.
Vulnerability Details
The contribute function fails to update contribution.amount with the contributed amount. It initializes to 0 for new contributions but never increments it, leaving the contribution record inaccurate.
Impact
Users cannot track their total contributions accurately, which may confuse them or break refund logic relying on this value. It doesn’t directly compromise funds but undermines program reliability
Tools Used
manual code review
Recommendations
Add a line to increment contribution.amount after the lamports transfer in the contribute function:
Appeal created
Contribution amount is not updated
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.