Submission Details
Severity:
Creator can withdraw funds if goal is not met
Summary
The creator is able to withdraw funds despite the goal not been met within the specified deadline
Vulnerability Details
This allows the creator to withdraw funds after the deadline has reached and the goals were not met and subsequently allows the creator to frontrun contributors from asking for a refund
Impact
Contributors are unable to get refunds after the deadline has reached
POC
Add this line in rustfund.ts#L95 before the refund
try{
await program.methods
.withdraw()
.accounts({
fund: fundPDA,
creator: creator.publicKey,
systemProgram: anchor.web3.SystemProgram.programId,
})
.rpc();
console.log("Successful Withdrawal when goal is not met"); // Transaction reaches here hence successful
}catch(e){
console.log(e);
}
Tools Used
Manual
Recommendations
Ensure the withdraw can only be called after the goal has been met
Add this check in withdraw
require!(ctx.accounts.fund.amount_raised >= ctx.accounts.fund.goal, ErrorCode::InsufficientFunds);
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Assigned finding tags:
No goal achievement check in `withdraw` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.