Summary

A vulnerability was discovered in the contribute function of the rustfund program. Specifically, there is no check to ensure that the total amount raised does not exceed the specified funding goal. This oversight can lead to potential overfunding, mismanagement of funds, and a discrepancy between the intended functionality and actual behavior of the contract.

Vulnerability Details

• Location: contribute function within the rustfund program.

• Issue: The function does not validate if the new contribution (amount) added to the existing fund.amount_raised exceeds the target fund.goal.

• Explanation: If the accumulated contributions surpass the defined funding goal, contributors may continue contributing, resulting in overfunding. The absence of a boundary check before updating fund.amount_raised leads to a overfunding.

Impact

1. Overfunding: Contributors may deposit funds even after reaching the funding goal, leading to unexpected surplus.

2. Financial Mismanagement: Funds raised beyond the goal may not be tracked or handled appropriately.

3. Reputation Risk: The integrity of the fundraising platform can be questioned if overfunding occurs, potentially violating trust and expectations.

4. Potential Overflow: In extreme cases, if contributions continue after the goal is reached, an integer overflow could occur, though this is mitigated by Rust’s overflow checks.

Tools Used

• Manual code review.

• Analysis through the Anchor framework.

• Knowledge of Solana’s system program for secure fund transfers.

Recommendations

• Validation Check: Before adding the contribution, ensure that the resulting amount_raised does not exceed the goal. Example fix:

• Error Handling: Introduce a new error variant in ErrorCode to handle the overfunding case:

• Testing: Implement tests to validate that:

  1. Contributions are rejected once the funding goal is met.

  2. The amount_raised never exceeds the goal.

• Documentation: Clearly specify the behavior of the contribute function in the program’s documentation to set accurate expectations.