RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No validation of the goal on the withdrawal function

yo4nn

Summary

The RustFund smart contract has a business logic flaw in his withdraw that breaks the secure withdrawal invariant

Vulnerability Details

The withdraw function does not check if the fundraising goal has been met before allowing the creator to withdraw funds, violating the intended business logic.

pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
let amount = ctx.accounts.fund.amount_raised;

Impact

Funds can be withdrawn before meeting the funding goal breaking the invariant of the protocol. This issue allows unauthorized fund withdrawals, which is critical for a crowdfunding smart contract.

Tools Used

Manual Review

Recommendations

Ensure that the goal is met before allowing withdrawals. So add a check that return an error if the goal is not reached.

if fund.amount_raised < fund.goal {
return Err(ErrorCode::GoalNotReached.into());
}
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

No goal achievement check in `withdraw` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.