RustFund

First Flight #36
Beginner FriendlyRust
100 EXP
View results
Submission Details
Severity: high
Valid

RustFund vulnerability report

Summary

There's a few potential vulnerabilities, mostly confined in a few functions

Vulnerability Details

  1. In the contribute function on line 50 fund.amount_raised is incremented by amount, but contribution.amount isn't updated, when it should also be incremented after the amount is transferred.

  2. There's likely a typo in dealine_set, did you mean deadline_set ?

  3. Withdraw function has no way to verify that the deadline has passed or if the goal was achieved

  4. Not all arithmetic operations are protected, such as line 50

Impact

  1. The contribution amount doesn't reflect the total amount contributed by the user. On line 37 contribution.amount is set to 0 and isn't updated, so contributors will lose their funds.

  2. No issues with the spelling, but could be confusing for future developers trying to understand it.

  3. The creator can withdraw amount_raised funds at any time, whether before the deadline, or even if the goal isn't met.

  4. Can result in integer overflow, leading to incorrect values, and withdrawing more than intended.

Recommendations

  1. Increment the contribution amount after the amount_raised: contribution.amount += amount

  2. Change the spelling to: deadline

  3. Add some condition that checks if the deadline has passed, or the goal was achieved

  4. Use checked arithmetic similar to how you have it elsewhere:
    fund.amount_raised = fund.amount_raised.checked_add(amount)
    .ok_or(ErrorCode::CalculationOverflow)?;

Updates

Lead Judging Commences

bube Lead Judge
2 months ago

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

No deadline check in `withdraw` function

No goal achievement check in `withdraw` function

[Invalid] Wrong naming of `deadline_set`

This is strong informational finding, there is no impact for the protocol. The variable is the same on all places.

[Invalid] Arithmetic overflow in `contribute` function

The max value of u64 is: 18,446,744,073,709,551,615 or around 18.4 billion SOL, given that the total supply of SOL on Solana is 512.50M, the scenario when the `contribute` function will revert due to overflow is very very unlikely to happen. Therefore, this is informational finding.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.