Submission Details
Severity:
fund.dealine is never updated in the function set_deadline
Summary
The function set_deadline as a check to see if deadline as been set
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
Ok(())
}
but fund.dealine_set is never updated after to show deadline as been set.
Vulnerability Details
Without this update of set_dealine, the creator can increase or reduce the dead line time at will as they want, which go against the logic of the program.
Impact
Malicious creator might increase or decrease dead line for campaign at will.
Tools Used
Manual code review
Recommendations
Add the below to set_deadline function after fund.deadline = deadline
+ fund.dealine_set = true;
Updates
Appeal created
bube 7 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.