Submission Details
Severity:
fund.goal and deadline are not checked on withdrawal
Summary
No Goal Reached Check or deadline check on Withdrawal
Vulnerability Details
There is no check to ensure the fund's goal has been reached or the deadline before allowing withdrawals.
pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
let amount = ctx.accounts.fund.amount_raised;
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
**ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.creator.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
Ok(())
}
}
Impact
withdrawal is possible while goal is not reached.
Tools Used
Manual review.
Recommendations
add a check for fund.goal and also check the deadline.
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Assigned finding tags:
No deadline check in `withdraw` function
No goal achievement check in `withdraw` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.