Submission Details
Severity:
Withdraw() doesn't check goal
Summary
The withdraw function isn't checking if the fund goal has been met
Vulnerability Details
The creator of the fund can withdraw the funds regardless of whether the funding goal has been reached because there is no check made against the goal before allowing the withdraw.
Impact
This goes against the protocol specification and a creator can choose to disregard the funding goal and withdraw funds as they please before contributors are able to refund their contributions.
Tools Used
Recommendations
Add a check for whether the fund goal is met:
if ctx.accounts.fund.amount_raised < ctx.accounts.fund.goal {
return Err(ProgramError::InsufficientFunds.into());
}
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Assigned finding tags:
No goal achievement check in `withdraw` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.