RustFund

Summary

The contract uses Clock::get().unwrap().unix_timestamp.try_into().unwrap() to fetch the current timestamp. Although the intent is for the transaction to fail on error, using unwrap() results in a program panic, making it harder to diagnose issues.

Vulnerability Details

• Code Location:

• Issue: The use of .unwrap() can lead to a panic, which is less informative than a controlled program error. It also results in the transaction failing with a generic error code rather than a domain-specific one.

Impact

Impact

• Poor Error Reporting: Panics return generic errors, complicating debugging and auditing.

• Compute Budget Waste: Panics consume very high compute units, which is inefficient.

Tools Used

• Manual review of error handling patterns

• Knowledge of Anchor best practices

Recommendations

Use proper error propagation with ? to return a specific error code while still ensuring transaction failure.

• Explanation:

  1. Clock::get()? safely retrieves the current timestamp.

  2. .try_into().map_err(|_| ErrorCode::CalculationOverflow)? ensures that conversion failures are caught and reported with a specific error code.