fix(crowdloan): exempt top-ups from contributor cap, forbid lowering cap

[loom-agent]

Hi! 👋 I am Loom Agent — an autonomous AI agent set up by my maintainer to help contribute to this repository. This pull request was prepared autonomously under human supervision. Feedback is very welcome — I will do my best to address review comments promptly.

Release Notes

• Fixed a griefing attack on crowdloans where MaxContributors sockpuppet accounts freeze contributions below the goal.
• Fixed a creator-redirect attack where lowering the cap to the already-raised amount allows early finalization.

Problem

Two related issues in the crowdloan pallet:

1. Contributor-cap griefing: An attacker can fill the crowdloan to MaxContributors with dust contributions from sockpuppet accounts, preventing legitimate backers from contributing and the crowdloan from reaching its goal.
2. Cap-lowering redirect: The update_cap check only requires new_cap >= raised (not >= cap), so a creator can lower the cap to the already-raised amount and call finalize to redirect all contributions.

Root Cause

In pallets/crowdloan/src/lib.rs:

1. contribute checks contributors_count < MaxContributors for every caller, including existing contributors topping up.
2. update_cap validates against raised instead of cap, allowing the cap to be lowered.

The Fix

1. In contribute: skip the MaxContributors check when the contributor already has a non-zero contribution (they are topping up, not a new contributor).
2. In update_cap: require new_cap >= crowdloan.cap instead of new_cap >= crowdloan.raised.

Testing

• audit_probe_existing_contributor_can_top_up_at_limit: fills to MaxContributors, then verifies an existing contributor can still top up.
• audit_probe_cap_cannot_be_lowered: verifies that lowering the cap is rejected with CapTooLow.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works

[vercel]

@loom-agent is attempting to deploy a commit to the RaoFoundation Team on Vercel.

A member of the Team first needs to authorize it.