Rust Fund

Root + Impact

Description

In programs/rustfund/src/lib.rs, contribute updates fund.amount_raised using unchecked += arithmetic while every other arithmetic operation in the program uses checked_add or checked_sub. In release builds without overflow checks, an overflow silently wraps the u64 counter; in builds with overflow checks enabled, it panics with an unnamed panic instead of returning ErrorCode::CalculationOverflow.

Risk

Likelihood: Low

Reaching u64::MAX total donated lamports (2^64 - 1) is unrealistic in practice.

Impact: Low

On overflow, fund.amount_raised either silently wraps in release builds or aborts the transaction with an unnamed panic rather than a structured CalculationOverflow error.

Proof of Concept

If fund.amount_raised is near u64::MAX and contribute is called with an amount such that fund.amount_raised + amount > u64::MAX, the += operator does not invoke checked_add and therefore either wraps or panics instead of returning ErrorCode::CalculationOverflow:

Recommended Mitigation

Replace fund.amount_raised += amount; with checked_add and return the existing ErrorCode::CalculationOverflow error on overflow so all arithmetic in the program is uniformly checked.