Assessment reports>Claim and Rewards Programs>Low findings>Claimable token close can be subjected to denial of service via dust attack
Category: Business Logic

Claimable token close can be subjected to denial of service via dust attack

Low Impact
Low Severity
Medium Likelihood

Description

When a claimable token account is about to be closed with a balance of zero, an attacker can perform a dust attack by transferring a very small amount of tokens with the same mint to that account before the close operation. This dust attack makes the balance nonzero, triggering the SPL token's zero-balance validation for close_account and causing the close operation to fail.

fn process_close_instruction<'a>(
    program_id: &Pubkey,
    token_account_info: AccountInfo<'a>,
    authority_account_info: AccountInfo<'a>,
    destination_account_info: AccountInfo<'a>,
    eth_address: EthereumAddress,
) -> Result<(), ProgramError> {
    ...

    invoke_signed(
        &spl_token::instruction::close_account( // <-----
            &spl_token::id(),
            token_account_info.key,
            destination_account_info.key,
            authority_account_info.key,
            &[authority_account_info.key],
        )?,
        &[token_account_info, destination_account_info, authority_account_info],
        seeds,
    )

}

Impact

The Close instruction can be subjected to a denial-of-service attack, preventing rent reclamation.

Recommendations

Extract the balance before performing the close operation.

Remediation

Zellic © 2025Back to top ↑