Rust Fund

Summary

contribute(0) succeeds: it pointlessly creates (and pays rent for) a Contribution account while transferring nothing.

Root Cause

In contribute() (programs/rustfund/src/lib.rs), there is no require!(amount > 0, ...) guard, so a zero-lamport contribution passes all checks and initializes a rent-paying PDA.

Impact

Low severity / Low likelihood: no direct fund loss; wastes the contributor's rent and clutters on-chain state. Zero-amount contributions can also skew off-chain contributor counts.

PoC

Call contribute(0) → returns Ok, Contribution account created with rent paid, 0 lamports moved. (Verified by code inspection.)

Mitigation

Add require!(amount > 0, InvalidAmount); in contribute().

Review notes

Access control on privileged fns (has_one = creator + Signer) and checked math on the transfers themselves were verified sound.