Root cause: name is declared max_len(200) but is also a PDA seed, and a Solana seed is capped at 32 bytes, while fund_create validates nothing. Impact: most of the advertised name range is unusable and rent is paid for unreachable space

Description

The README advertises campaigns "with custom names, descriptions, and funding goals", and the Fund account reserves room for a 200 byte name. Space is allocated and paid for on that basis.

The same name is used as a PDA seed in FundCreate, and a Solana seed cannot exceed 32 bytes. Anything longer cannot even have its address derived, so the campaign is impossible to create. fund_create also writes both strings straight into the account without checking either length.

Risk

Likelihood:

• Any creator picking a name longer than 32 bytes hits this immediately. Thirty-two bytes is short for a campaign title, so this is ordinary usage rather than an edge case.

• The failure surfaces as Max seed length exceeded during address derivation, which gives no hint that the name is the cause.

Impact:

• Six sevenths of the advertised name range is unusable, so the documented feature does not work as described.

• Every campaign pays rent for 5273 bytes, of which 168 name bytes can never be filled, and there is no validation to reject oversized input early or to keep the reserved space in line with what is reachable.

Proof of Concept

There is no attacker here. The affected party is any creator whose campaign title runs past 32 bytes. Run with anchor test.

Output:

A second test reads the created account back: it occupies 5273 bytes and holds 37,590,960 lamports of rent, while 168 of the reserved name bytes are permanently unreachable.

To be clear about the limits of this finding, no funds are at risk and nothing can be stolen through it. A third test confirms a normally named campaign contributes and accounts correctly, so this is a functionality and cost issue rather than a security one, which is why I am filing it as Low.

Recommended Mitigation

Validate the inputs in fund_create and align the declared length with what a seed allows:

and change the account definition to #[max_len(32)] for name, which also reduces the rent every campaign pays. If longer titles are wanted, derive the PDA from a hash of the name, or from a counter, and keep the readable title purely as stored data.