Submission Details
Severity:
Contribution fails as transfer sol from PDA works with .try_borrow_mut_lamports()? +/- but not with transfer instruction
Summary
Transfer sol from PDA works with .try_borrow_mut_lamports()? but not with transfer instruction preventing accounts from contributing.
Vulnerability Details
Contributors are PDA and PDA aren't be able to call transfer that is called in contribute function. This call fails, preventing accounts from contributing.
// Transfer SOL from contributor to fund account
let cpi_context = CpiContext::new(
ctx.accounts.system_program.to_account_info(),
system_program::Transfer {
from: ctx.accounts.contributor.to_account_info(),
to: fund.to_account_info(),
},
);
system_program::transfer(cpi_context, amount)?;
Impact
Contributions will not be performed successfully
Tools Used
Manual Review
Recommendations
Use .try_borrow_mut_lamports()? instead
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.