Submission Details
Severity:
Contributor not being credited after donation.
Summary
amount not being accounted when the contributor sends money to the crowdfunding.
Vulnerability Details
in the contribute function contribution.amount is being set to 0 but should be set to the parameter amount, like this the amount is not being accounted to the contributor but the value is being sent.
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0;
}
Impact
contributor not being credit for the donation and in case the crowdfunding never hit the goal he can't get his money back.
Tools Used
manual
Recommendations
contribution.amount += amount should be used instead or a safer way of adding two numbers.
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Assigned finding tags:
Contribution amount is not updated
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.