Rust Fund
AI First Flight #9
Beginner FriendlyRust
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Campaign `name` PDA seed exceeds Solana's 32-byte limit, causing transaction failure for valid declared names

eabrf94

Description

The Fund struct declares name with #[max_len(200)], implying that campaign names up to 200 bytes are supported. However, in FundCreate, name.as_bytes() is directly used as a PDA seed:

#[derive(Accounts)]
#[instruction(name: String)]
pub struct FundCreate<'info> {
#[account(
init,
payer = creator,
space = 8 + Fund::INIT_SPACE,
@> seeds = [name.as_bytes(), creator.key().as_ref()],
bump
)]
pub fund: Account<'info, Fund>,
#[account(mut)]
pub creator: Signer<'info>,
pub system_program: Program<'info, System>,
}
​
#[account]
#[derive(InitSpace)]
pub struct Fund {
@> #[max_len(200)]
pub name: String,
#[max_len(5000)]
pub description: String,
...

The Solana runtime strictly limits the length of any individual PDA seed to 32 bytes (solana_program::pubkey::MAX_SEED_LEN = 32). If a user attempts to create a campaign with a name between 33 and 200 bytes, find_program_address or create_program_address fails with PubkeyError::MaxSeedLengthExceeded.

Risk

Likelihood: Medium (Any campaign title longer than 32 characters triggers the error)

Impact: Medium (Blocks campaign creation for valid descriptive names within the declared 200-byte boundary)

Proof of Concept

  1. A creator attempts to launch a campaign titled: "Clean Water & Energy Initiative 2025".

  2. The byte length of this UTF-8 string is 38 bytes (> 32 bytes).

  3. Anchor attempts to derive the PDA address using name.as_bytes().

  4. The Solana runtime aborts the transaction with MaxSeedLengthExceeded.

Recommended Mitigation

Either enforce that name is limited to at most 32 bytes in the instruction and data struct, or hash the name using SHA-256 to ensure a constant 32-byte seed:

#[account(
init,
payer = creator,
space = 8 + Fund::INIT_SPACE,
- seeds = [name.as_bytes(), creator.key().as_ref()],
+ seeds = [anchor_lang::solana_program::hash::hash(name.as_bytes()).to_bytes().as_ref(), creator.key().as_ref()],
bump
)]
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!