Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Rust Fund
Submissions
AI First Flight
Rust Fund
AI First Flight #9
Beginner Friendly
Rust
EXP
AI First Flight
EXP
Oct 10th, 2026 → Oct 12th, 2026
View repo
View results
7 / 7
Submissions
Severity
Validity
Tags
Author
#1
contribute() never records contribution.amount, so refund() always pays 0 lamports and contributors to a failed campaign can never get their SOL back
High
Valid
[H-03] Permanent Loss of Co...
friedsocks233
#2
withdraw() checks only who calls it, never the goal or the deadline, so a campaign creator can take all contributed SOL at any time, including mid-campaign and after the campaign has failed
High
Valid
[H-01] No check for if camp...
friedsocks233
#3
refund() never checks the goal and treats an unset deadline (0) as reached, so contributors can refund from campaigns that met their goal, and at any time from campaigns with no deadline
High
Valid
[H-04] Inadequate Refund Co...
friedsocks233
#4
set_deadline() never sets dealine_set and never validates the new value, so the creator can rewrite the deadline at any time: reopen an expired campaign, cut a running one short, or postpone refunds indefinitely
Medium
Valid
[M-02] The set_deadline fun...
friedsocks233
#5
withdraw() never resets amount_raised and the Fund has no withdrawn state, so a paid-out campaign keeps accepting SOL and every later withdraw() of that SOL fails
Medium
Valid
[M-01] Withdrawal doesn't r...
friedsocks233
#6
The Fund PDA is seeded with the raw campaign name and Solana limits seeds to 32 bytes, so fund_create() fails for every name of 33-200 bytes although the account reserves 200 bytes for the name
Low
Invalid
friedsocks233
#7
No instruction closes Contribution or Fund accounts, so each contributor's Contribution rent and each creator's Fund rent stay locked in program-owned accounts with no way to reclaim them
Low
Valid
[L-04] Unclaimed rent from ...
friedsocks233
Previous
1
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
