RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Contribution Amount Not Recorded Properly in contribute Function

0xkmr_

Summary

In the contribute function when a new contributioin record is iitialized, the contribution amount is incorrectly set to a hardcoded value of '0' instead of the user-provided amount parameter.

Vulnerability Details

When a User contributes to a fund for the first time, the protocol initializes a new contributioin record to track their contribution. However, the amount field in this record is set to '0' rather than the actual contribution amount. The Actual Bug raises when the User Tries to refund the amount which was contributed. Because of having 0 in the contributioin.amount the user will get nothing if the User tries to refund the sol. The User funds will be lost.

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = 0; //@audit --> Mistakenly put the '0'.
}

Attack Scenario

  1. User A will contribute 5 sol to the Fund_x Account.

  2. The User A contribution will be stored as 0 instead of 5 sol.

  3. Now if the User tries to refund the sol. User will get nothing due to the fact that the user.contribution variable is set to '0'.

  4. User successfully Lost his Sol.

Impact

High

Tools Used

Manual Review

Recommendations

pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let contribution = &mut ctx.accounts.contribution;
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
// Initialize or update contribution record
if contribution.contributor == Pubkey::default() {
contribution.contributor = ctx.accounts.contributor.key();
contribution.fund = fund.key();
contribution.amount = amount; //Add this line
}
Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contribution amount is not updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.