Rust Fund
AI First Flight #9
Beginner FriendlyRust
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Root cause: amount_raised is only ever increased, never decreased by withdraw or refund. Impact: the counter permanently overstates the balance, and after the first payout the campaign can never pay out again

hati

Root cause: amount_raised is only ever increased, never decreased by withdraw or refund. Impact: the counter permanently overstates the balance, and after the first payout the campaign can never pay out again

Description

amount_raised is the program's record of what a campaign currently holds, and withdraw uses it to decide how many lamports to move. For that to be correct it must go down whenever lamports leave the fund.

It never does. The field appears four times in the program: initialised to zero at line 19, increased in contribute at line 50, read by withdraw at line 91, and declared at line 189. Neither withdraw nor refund decrements it, even though both move lamports out of the fund account.

// programs/rustfund/src/lib.rs
pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
let amount = ctx.accounts.fund.amount_raised;
// ... lamports are moved from the fund to the creator ...
@> // fund.amount_raised is never reset here
Ok(())
}
​
pub fn refund(ctx: Context<FundRefund>) -> Result<()> {
// ... lamports are moved from the fund back to the contributor ...
ctx.accounts.contribution.amount = 0;
@> // fund.amount_raised is not decremented either
Ok(())
}

So the counter only grows, while the real balance rises and falls. Once they diverge, withdraw asks for more lamports than the account holds and reverts, and the campaign is stuck in that state permanently.

Risk

Likelihood:

  • The divergence appears on the very first payout of any campaign, with no attacker and no unusual sequence. Every campaign that ever pays out reaches this state.

  • Nothing in the program can restore the counter: there is no setter, no admin instruction, and no way to close or reinitialise the fund.

Impact:

  • After a payout, any further contributions to that campaign can never be withdrawn by the creator, because the counter demands more than the account contains. Those lamports are frozen in the fund.

  • The stored figure is wrong for anyone reading it, so a front end reporting campaign progress from amount_raised shows a total that was already paid out.

Proof of Concept

There is no attacker here, the program simply loses track of its own balance. The victims are later contributors, whose SOL becomes unreachable. Run with anchor test.

it("H-2 stale amount_raised bricks the fund after the first withdraw", async () => {
const fund = await createFund("h2brick");
const bob = await fundedKeypair();
const eve = await fundedKeypair();
​
await contributeFrom(fund, bob, CONTRIB); // bob puts in 2 SOL
await program.methods // creator takes it
.withdraw()
.accounts({ fund, creator: creator.publicKey, systemProgram: SystemProgram.programId })
.rpc();
​
const mid = await program.account.fund.fetch(fund);
expect(mid.amountRaised.toString()).to.equal(CONTRIB.toString()); // counter not reset
​
const ONE = new BN(1 * LAMPORTS_PER_SOL);
await contributeFrom(fund, eve, ONE); // eve now puts in 1 SOL
​
let failed = false;
try {
await program.methods // creator tries to withdraw it
.withdraw()
.accounts({ fund, creator: creator.publicKey, systemProgram: SystemProgram.programId })
.rpc();
} catch (e) {
failed = true; // counter says 3 SOL, only 1 is there
}
expect(failed).to.be.true;
});

Output:

amount_raised after first withdraw: 2000000000
real lamports in fund: 1037590960 but amount_raised claims: 3000000000
withdraw now reverts with InsufficientFunds

A second test measures the divergence on its own: after a full withdrawal the fund holds 37,590,960 lamports of rent while the counter still reports 2,000,000,000. A third confirms refund behaves the same way, leaving the counter at 2,000,000,000 before and after.

To be precise about the limits of this: the stale counter does not allow over-withdrawal. checked_sub reverts rather than draining past the balance, and I verified the creator gains nothing from the failed second call. The damage is a permanent denial of service on the campaign, not extra theft.

Recommended Mitigation

Decrease the counter wherever lamports leave the fund:

// in withdraw, before moving the lamports
let amount = fund.amount_raised;
fund.amount_raised = 0;
​
// in refund
fund.amount_raised = fund.amount_raised
.checked_sub(amount)
.ok_or(ErrorCode::CalculationOverflow)?;

With both in place the counter always matches what the account actually holds, and a campaign remains usable after its first payout.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] Withdrawal doesn't reset amount_raised, leading to locked funds

## Description The `withdraw()` function in the `rustfund` program contains a vulnerability where the `amount_raised` state variable is never reset to zero after a successful withdrawal. This leads to a situation where new contributions after a withdrawal are effectively locked in the contract, as subsequent withdrawal attempts will fail due to insufficient funds. ```rust pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> { let amount = ctx.accounts.fund.amount_raised; **ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? = ctx.accounts.fund.to_account_info().lamports() .checked_sub(amount) .ok_or(ProgramError::InsufficientFunds)?; **ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? = ctx.accounts.creator.to_account_info().lamports() .checked_add(amount) .ok_or(ErrorCode::CalculationOverflow)?; // Missing: fund.amount_raised = 0; Ok(()) } ``` The key issue is that after transferring the funds to its creator, the function does not reset the `amount_raised` variable. This means that if new contributions are made after a withdrawal, the `amount_raised` value will continue to accumulate. When the creator attempts to withdraw again, the contract will try to transfer the entire `amount_raised` value, which will be larger than the actual balance in the fund account, resulting in an `InsufficientFunds` error. ## Impact 1. **Permanently locked funds**: Any contributions made after a successful withdrawal will be permanently locked in the contract, as the creator cannot withdraw them. 2. **Campaign dysfunction**: The crowdfunding mechanism becomes dysfunctional after the first withdrawal, as any new funds contributed cannot be properly managed. ## Proof of Concept (PoC) The following test demonstrates how funds become locked after a withdrawal due to the amount_raised not being reset: ```javascript import * as anchor from "@coral-xyz/anchor"; import { Program } from "@coral-xyz/anchor"; import { Rustfund } from "../target/types/rustfund"; import { PublicKey } from '@solana/web3.js'; import { expect } from 'chai'; describe("amount_raised is never reset", () => { const provider = anchor.AnchorProvider.env(); anchor.setProvider(provider); const program = anchor.workspace.Rustfund as Program<Rustfund>; const creator = provider.wallet; const otherUser = anchor.web3.Keypair.generate(); const fundName = "0xWithdrawers Fund04"; const description = "VULN-04"; const goal = new anchor.BN(1000000000); // 1 SOL const contribution = new anchor.BN(1000000000); // 1 SOL let fundPDA: PublicKey; let contributionPDA: PublicKey; before(async () => { // Generate PDA for fund [fundPDA] = await PublicKey.findProgramAddress( [Buffer.from(fundName), creator.publicKey.toBuffer()], program.programId ); // Airdrop some SOL to the other user for testing const airdropSignature = await provider.connection.requestAirdrop( otherUser.publicKey, 2 * anchor.web3.LAMPORTS_PER_SOL ); await provider.connection.confirmTransaction(airdropSignature); }); it("Creates a fund", async () => { await program.methods .fundCreate(fundName, description, goal) .accounts({ fund: fundPDA, creator: creator.publicKey, systemProgram: anchor.web3.SystemProgram.programId, }) .rpc(); }); it("Contributes to fund", async () => { // Generate PDA for contribution [contributionPDA] = await PublicKey.findProgramAddress( [fundPDA.toBuffer(), provider.wallet.publicKey.toBuffer()], program.programId ); // Perform a contribution of 1 SOL await program.methods .contribute(contribution) .accounts({ fund: fundPDA, contributor: provider.wallet.publicKey, contribution: contributionPDA, systemProgram: anchor.web3.SystemProgram.programId, }) .rpc(); const fund = await program.account.fund.fetch(fundPDA); expect(fund.amountRaised.toString()).to.equal(contribution.toString()); }); it("Creator withdraws funds", async () => { const fundBalanceBefore = await provider.connection.getBalance(fundPDA); // Creator withdraws all funds await program.methods .withdraw() .accounts({ fund: fundPDA, creator: creator.publicKey, systemProgram: anchor.web3.SystemProgram.programId, }) .rpc(); const fundBalanceAfter = await provider.connection.getBalance(fundPDA); expect(fundBalanceAfter).to.be.below(fundBalanceBefore); // VULNERABILITY: amount_raised is not reset to 0 after withdrawal const fundAfterWithdrawal = await program.account.fund.fetch(fundPDA); expect(fundAfterWithdrawal.amountRaised.toString()).to.equal(contribution.toString()); }); it("New contributions are locked after withdrawal due to VULN-04", async () => { // Generate PDA for otherUser's contribution const [otherUserContributionPDA] = await PublicKey.findProgramAddress( [fundPDA.toBuffer(), otherUser.publicKey.toBuffer()], program.programId ); // Make another contribution from a different user const secondContribution = new anchor.BN(500000000); // 0.5 SOL await program.methods .contribute(secondContribution) .accounts({ fund: fundPDA, contributor: otherUser.publicKey, contribution: otherUserContributionPDA, systemProgram: anchor.web3.SystemProgram.programId, }) .signers([otherUser]) .rpc(); // VULNERABILITY: Since the amount_raised wasn't reset, it now includes both contributions const fundAfterSecondContribution = await program.account.fund.fetch(fundPDA); const expectedTotal = contribution.add(secondContribution); expect(fundAfterSecondContribution.amountRaised.toString()).to.equal(expectedTotal.toString()); // Now try to withdraw the second contribution try { await program.methods .withdraw() .accounts({ fund: fundPDA, creator: creator.publicKey, systemProgram: anchor.web3.SystemProgram.programId, }) .rpc(); // If we reach this point, the test has failed expect.fail("Withdrawal should have failed due to insufficient funds"); } catch (error) { // Verify it's the expected error (insufficient funds) expect(error.message).to.include("InsufficientFunds"); } }); }); ``` Save the above test as `tests/04.ts` in your project's test directory and run the test: ```Solidity anchor test ``` ## Concrete Impact Example To illustrate the real-world impact of this vulnerability, consider this scenario: 1. A creator launches a campaign to fund a 10 SOL project. 2. Contributors donate a total of 10 SOL, reaching the goal. 3. The creator withdraws the 10 SOL (withdrawal succeeds) when goal is reached and deadline past. 4. The `amount_raised` in the contract remains at 10 SOL, though the actual balance is now 0. 5. A new contributor donates 2 SOL to support the ongoing project. 6. The creator tries to withdraw this new contribution. 7. The withdrawal fails with an "InsufficientFunds" error because the contract tries to withdraw 12 SOL (the accumulated `amount_raised`), but only 2 SOL is available in the account. 8. The 2 SOL contribution is now permanently locked in the contract, with no mechanism to withdraw it. ## Recommendation The `withdraw()` function should be modified to reset the `amount_raised` value to zero after a successful withdrawal: ```rust pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> { let amount = ctx.accounts.fund.amount_raised; **ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? = ctx.accounts.fund.to_account_info().lamports() .checked_sub(amount) .ok_or(ProgramError::InsufficientFunds)?; **ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? = ctx.accounts.creator.to_account_info().lamports() .checked_add(amount) .ok_or(ErrorCode::CalculationOverflow)?; // Reset amount_raised to 0 after successful withdrawal ctx.accounts.fund.amount_raised = 0; Ok(()) } ``` This fix ensures that after each withdrawal, the `amount_raised` is reset to zero, allowing new contributions to be properly accounted for and subsequently withdrawn by the creator.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!