Rust Fund
AI First Flight #9
Beginner FriendlyRust
EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Creators can withdraw funds from unsuccessful campaigns

hongphat19

Root + Impact

Description

RustFund's README states that creators can withdraw raised funds after successful campaigns, while contributors can request refunds when the campaign fails to meet its goal after the deadline.

The withdraw instruction only checks that the signer is the fund creator through the account constraint. It does not verify that the campaign has met its funding goal, and it does not require the campaign to be in a successful state. A creator can therefore withdraw contributor SOL even when the campaign raised less than the goal.

pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
@> let amount = ctx.accounts.fund.amount_raised;
​
@> **ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.fund.to_account_info().lamports()
.checked_sub(amount)
.ok_or(ProgramError::InsufficientFunds)?;
​
@> **ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? =
ctx.accounts.creator.to_account_info().lamports()
.checked_add(amount)
.ok_or(ErrorCode::CalculationOverflow)?;
​
Ok(())
}
​
#[derive(Accounts)]
pub struct FundWithdraw<'info> {
@> #[account(mut, seeds = [fund.name.as_bytes(), creator.key().as_ref()], bump,has_one = creator)]
pub fund: Account<'info, Fund>,
#[account(mut)]
pub creator: Signer<'info>,
}

Risk

Likelihood:

  • Any campaign creator can call withdraw after at least one contribution because no success condition is checked.

  • The vulnerable path does not require timing precision or special account setup beyond being the fund creator.

Impact:

  • Contributors can lose SOL to creators even when the campaign failed to meet its funding target.

  • The refund mechanism is bypassed because the fund account's lamports are removed before contributors can recover them.

Proof of Concept

// 1. Creator creates a fund with goal = 1 SOL.
await program.methods.fundCreate("fund", "desc", new anchor.BN(1_000_000_000)).accounts(...).rpc();
​
// 2. A contributor contributes only 0.5 SOL, so the campaign is unsuccessful.
await program.methods.contribute(new anchor.BN(500_000_000)).accounts(...).rpc();
​
// 3. Creator calls withdraw even though amountRaised < goal.
await program.methods.withdraw().accounts({
fund: fundPda,
creator: creator.publicKey,
systemProgram: anchor.web3.SystemProgram.programId,
}).rpc();

The call succeeds because withdraw never checks fund.amount_raised >= fund.goal. The creator receives the contributed lamports from an unsuccessful campaign.

Recommended Mitigation

Require campaign success before allowing withdrawal. The exact timing rule depends on the intended lifecycle, but at minimum the campaign should have met its goal.

pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> {
+ let fund = &ctx.accounts.fund;
+ require!(fund.amount_raised >= fund.goal, ErrorCode::CampaignNotSuccessful);
+
- let amount = ctx.accounts.fund.amount_raised;
+ let amount = fund.amount_raised;
// transfer lamports...
Ok(())
}

Add a dedicated error:

pub enum ErrorCode {
+ #[msg("Campaign has not met its funding goal")]
+ CampaignNotSuccessful,
}
​
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[H-02] H-01. Creators Can Withdraw Funds Without Meeting Campaign Goals

# H-01. Creators Can Withdraw Funds Without Meeting Campaign Goals **Severity:** High\ **Category:** Fund Management / Economic Security Violation ## Description The `withdraw` function in the RustFund contract allows creators to prematurely withdraw funds without verifying if the campaign goal was successfully met. ## Vulnerability Details In the current RustFund implementation (`lib.rs`), the `withdraw` instruction lacks logic to verify that the campaign's `amount_raised` is equal to or greater than the `goal`. Consequently, creators can freely withdraw user-contributed funds even when fundraising objectives haven't been met, undermining the core economic guarantees of the platform. **Vulnerable Component:** - File: `lib.rs` - Function: `withdraw` - Struct: `Fund` ## Impact - Creators can prematurely drain user-contributed funds. - Contributors permanently lose the ability to receive refunds if the creator withdraws early. - Severely damages user trust and undermines the economic integrity of the RustFund platform. ## Proof of Concept (PoC) ```js // Create fund with 5 SOL goal await program.methods .fundCreate(FUND_NAME, "Test fund", new anchor.BN(5 * LAMPORTS_PER_SOL)) .accounts({ fund, creator: creator.publicKey, systemProgram: SystemProgram.programId, }) .signers([creator]) .rpc(); // Contribute only 2 SOL (below goal) await program.methods .contribute(new anchor.BN(2 * LAMPORTS_PER_SOL)) .accounts({ fund, contributor: contributor.publicKey, contribution, systemProgram: SystemProgram.programId, }) .signers([contributor]) .rpc(); // Set deadline to past await program.methods .setDeadline(new anchor.BN(Math.floor(Date.now() / 1000) - 86400)) .accounts({ fund, creator: creator.publicKey }) .signers([creator]) .rpc(); // Attempt withdrawal (should fail but succeeds) await program.methods .withdraw() .accounts({ fund, creator: creator.publicKey, systemProgram: SystemProgram.programId, }) .signers([creator]) .rpc(); /* OUTPUT: Fund goal: 5 SOL Contributed amount: 2 SOL Withdrawal succeeded despite not meeting goal Fund balance after withdrawal: 0.00089088 SOL (rent only) */ ``` ## Recommendations Add conditional logic to the `withdraw` function to ensure the campaign has reached its fundraising goal before allowing withdrawals: ```diff pub fn withdraw(ctx: Context<FundWithdraw>) -> Result<()> { let fund = &mut ctx.accounts.fund; + require!(fund.amount_raised >= fund.goal, ErrorCode::GoalNotMet); let amount = fund.amount_raised; **ctx.accounts.fund.to_account_info().try_borrow_mut_lamports()? = ctx.accounts.fund.to_account_info().lamports() .checked_sub(amount) .ok_or(ProgramError::InsufficientFunds)?; **ctx.accounts.creator.to_account_info().try_borrow_mut_lamports()? = ctx.accounts.creator.to_account_info().lamports() .checked_add(amount) .ok_or(ErrorCode::CalculationOverflow)?; Ok(()) } ``` Also define the new error clearly: ```diff #[error_code] pub enum ErrorCode { // existing errors... + #[msg("Campaign goal not met")] + GoalNotMet, } ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!