There's a few potential vulnerabilities, mostly confined in a few functions
In the contribute function on line 50 fund.amount_raised is incremented by amount, but contribution.amount isn't updated, when it should also be incremented after the amount is transferred.
There's likely a typo in dealine_set, did you mean deadline_set ?
Withdraw function has no way to verify that the deadline has passed or if the goal was achieved
Not all arithmetic operations are protected, such as line 50
The contribution amount doesn't reflect the total amount contributed by the user. On line 37 contribution.amount is set to 0 and isn't updated, so contributors will lose their funds.
No issues with the spelling, but could be confusing for future developers trying to understand it.
The creator can withdraw amount_raised funds at any time, whether before the deadline, or even if the goal isn't met.
Can result in integer overflow, leading to incorrect values, and withdrawing more than intended.
Increment the contribution amount after the amount_raised: contribution.amount += amount
Change the spelling to: deadline
Add some condition that checks if the deadline has passed, or the goal was achieved
Use checked arithmetic similar to how you have it elsewhere:
fund.amount_raised = fund.amount_raised.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
This is strong informational finding, there is no impact for the protocol. The variable is the same on all places.
The max value of u64 is: 18,446,744,073,709,551,615 or around 18.4 billion SOL, given that the total supply of SOL on Solana is 512.50M, the scenario when the `contribute` function will revert due to overflow is very very unlikely to happen. Therefore, this is informational finding.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.