Rust Fund
AI First Flight #9
Beginner FriendlyRust
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

fund_create() does not validate name/description lengths — names over 32 bytes always fail PDA derivation (despite max_len(200)) and descriptions over 5000 bytes fail serialization with no clear error

sillyrobot796

Root + Impact

Description

  • Input validation at the entry point is expected to reject oversized inputs with a clear custom error before any state is created.

  • The fund PDA is seeded with name.as_bytes(), but Solana caps each seed at 32 bytes — #[max_len(200)] invites names that make find_program_address fail (MaxSeedLengthExceeded). Separately, a description over 5000 bytes overflows the allocated account space and reverts at Anchor's exit serialization. Neither path yields a custom ErrorCode.

seeds = [name.as_bytes(), creator.key().as_ref()], bump, // @> seed cap 32 vs max_len(200)
​
#[max_len(200)] // @> allows 200, PDA derivation dies above 32
pub name: String,
#[max_len(5000)] // @> over-long description -> space overflow at serialization
pub description: String,

Risk

Likelihood:

  • Reason 1: A 33-byte name is an ordinary user input ("Whale Conservation Initiative - Phase 2 (Pacific Region)" already exceeds it).

  • Reason 2: The declared max_len(200) actively invites long names rather than warning against them.

Impact:

  • Impact 1: Campaign creation and all name-seeded instructions fail with the un-actionable MaxSeedLengthExceeded, burning retry fees and support load.

  • Impact 2: The description overflow reverts the entire fund_create transaction with no custom error, leaving users no diagnosis path.

Proof of Concept

Two one-transaction reproductions of the size mismatches:

await program.methods.fundCreate("a".repeat(33), "legit description", new BN(1))
.accounts({ fund: fundPda, creator: attacker, systemProgram: SystemProgram.programId })
.signers([attacker]).rpc();
// -> MaxSeedLengthExceeded — despite max_len(200) advertising 200 bytes as fine
​
await program.methods.fundCreate("ok-name", "b".repeat(5001), new BN(1))
.accounts({ fund: fundPda2, creator: attacker, systemProgram: SystemProgram.programId })
.signers([attacker]).rpc();
// -> reverts at Anchor serialization (space overflow), no custom error

Expected result: a 33-byte name fails with MaxSeedLengthExceeded; a 5,001-byte description fails with a bare serialization revert — neither explainable to the user.

Recommended Mitigation

Reject oversized inputs at the top of fund_create() with dedicated error codes so users get an actionable message instead of a runtime failure. Alternatively, hash the name into the seeds to keep max_len(200) — then shrink #[max_len] to 32 only if names stay human-readable seeds.

+ require!(name.len() <= 32, ErrorCode::InvalidNameLength);
+ require!(description.len() <= 5000, ErrorCode::InvalidDescriptionLength);
fund.name = name;
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!