Rust Fund

Summary

The FundCreate PDA is derived with seeds [name.as_bytes(), creator]; Solana PDA seeds are capped at 32 bytes each, so any fund name longer than 32 bytes makes fund_create revert — while #[max_len(200)] on the name field advertises 200 bytes.

Root Cause

In programs/rustfund/src/lib.rs, #[derive(Accounts)] FundCreate uses seeds = [name.as_bytes(), creator.key().as_ref()], but the Fund account declares #[max_len(200)] pub name: String. The PDA seed limit (32 bytes) is hit long before the advertised 200-byte limit, so fund_create with a 33+ byte name fails at PDA derivation.

Impact

Low severity / Low likelihood: usability-only; no funds at risk. Long-but-advertised names are unusable, contradicting the account schema.

PoC

Call fund_create with a 33-byte name → PDA derivation reverts (seed > 32 bytes); a 32-byte name succeeds. (Verified by code inspection against the documented Solana PDA seed limit.)

Mitigation

Change #[max_len(200)] to #[max_len(32)] on name, or hash the name (e.g. sha256(name)) into the seeds.

Review notes

Access control on privileged fns (has_one = creator + Signer) and checked math on the transfers themselves were verified sound.