RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Creator is unable to reclaim rent after crowdfunding

chinepun

Summary

The creator is unable to reclaim the rent used to create the fund account after withdrawal

Vulnerability Details

Lamports will be stuck in the Fund Account PDA and will unable to be claimed.

Impact

The lamports used to create the fund account are stuck in the fund account and cannot be reclaimed by the creator

Tools Used

Manual

POC

Add this is rustfund.ts#L131

const fundPDAExists = await provider.connection.getAccountInfo(fundPDA);
​
console.log("fundPDAExists", fundPDAExists);

This does not fail because the Fund Account PDA still exists

Recommendations

Close the fund account upon successful withdrawal.

#[derive(Accounts)]
pub struct FundWithdraw<'info> {
#[account(mut, seeds = [fund.name.as_bytes(), creator.key().as_ref()], bump,has_one = creator, close = creator)]
pub fund: Account<'info, Fund>,
#[account(mut)]
pub creator: Signer<'info>,
pub system_program: Program<'info, System>,
}
Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Accounts are not closed after withdraw and refund

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.