Submission Details
Severity:
Contributor amount is always zero after contributions
Summary
The contributor's contribution account does not get updated after a successful contribution
Vulnerability Details
Contributors are allowed to contribute to a particular fund account multiple times, however the amount they have contributed is not recorded to their contribution account
Impact
This means that contributors are not able to get refunds on their accounts whenever the goal is not met because the amount they contributed was never updated in the first place.
Tools Used
Manual
POC
Add this to rustfund.ts#L86
console.log("Contributed amount", contributionAccount.amount.toNumber()); // This outputs 0
Recommendations
Ensure the contributors amount is updated after each contribution
Add this in contribute
contribution.amount += amount;
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Assigned finding tags:
Contribution amount is not updated
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.