RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contributors Can Refund Even If Campaign Goal Is Met

i_atiq

Summary

The refund function currently allows contributors to receive refunds even if the campaign goal has been met. This contradicts the intended behavior mentioned in project features, which states that contributors should only be able to refund if the deadline is reached and the fundraising goal is not met.

Vulnerability Details

Currently, the function only checks whether the deadline has been reached:

if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}

However, it does not check whether ctx.accounts.fund.amount_raised < ctx.accounts.fund.goal. This means contributors can claim refunds even if the campaign was successful

Impact

  • A campaign that successfully raised the required amount could be drained by contributors requesting refunds.

  • The project might not receive the expected funding despite meeting its target.

  • This could lead to unintended financial losses for fundraisers.

Tools Used

  • Manual code review

Recommendations

Modify the refund function to ensure refunds are only allowed if the deadline has passed and the goal was not met:

pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
​
let amount = ctx.accounts.contribution.amount;
if ctx.accounts.fund.deadline != 0 && ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
​
+ if ctx.accounts.fund.amount_raised >= ctx.accounts.fund.goal {
+ return Err(ErrorCode::GoalMetNoRefund.into()); // Prevent refund if goal is met
+ }
**ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
**ctx.accounts.contributor.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.contributor.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
​
// Reset contribution amount after refund
ctx.accounts.contribution.amount = 0;
Ok(())
}
Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

There is no check for goal achievement in `refund` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.