Reentrancy attack in refund()
Summary
Refund() is susceptible to a reentrancy attack.
Vulnerability Details
The contribution amount only gets updated after the transfer of funds. This means that if a user calls the refund() function repeatedly, they can transfer all the funds to themselves before the state of the account is updated.
Impact
A malicious user can exploit this vulnerability to drain all the funds from a fund.
Tools Used
Recommendations
Follow the CEI "Checks-Effects-Interactions" pattern by setting ctx.accounts.contribution.amount = 0 before the transfer of funds.
Appeal created
[Invalid] Reentrancy in refund
The reentrancy risk on Solana is highly eliminated. The `try_borrow_mut_lamports` ensures that only one reference to an account exists at a time. Also, once the fund’s lamports are borrowed mutably, no other transaction can modify them until the borrow is released. This means the function will reset the `amount` before the next call.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.