Submission Details
Severity:
No access control on withdraw()
Summary
Withdraw() is missing access control on the fund creator
Vulnerability Details
Withdraw() lacks a check verifying whether the creator specified in the FundWithdrawstruct is the same as the creator of the fund.
Impact
Any malicious user can impersonate the creator of the fund and invoke FundWithdrawto drain all funds.
Tools Used
N/A
Recommendations
Implement access control before allowing the withdrawal:
if ctx.accounts.creator.key() != ctx.accounts.fund.creator {
return Err(ErrorCode::UnauthorizedAccess.into());
}
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
[Invalid] Lack of access control in `withdraw` function
There are enough security checks in `withdraw` function. Anchor enforces that creator must sign the transaction. And the `has_one = creator` ensures that the fund’s creator matches the provided creator account.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.