Submission Details
Severity:
`Rustfund::set_deadline` can be set multiple times
Summary
any creator can set their own fund campaign deadline multiple times
Vulnerability Details
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
Ok(())
}
the function set_deadline only set the deadline but does not set the flag dealine_set to true, making the check if deadline already set redundant
for PoC, applied the diff:
diff --git a/tests/rustfund.ts b/tests/rustfund.ts
index 17382c7..03adeca 100644
--- a/tests/rustfund.ts
+++ b/tests/rustfund.ts
describe("rustfund", () => {
});
+ it("PoC: Sets a deadline multiple times", async () => {
+ // Set deadline again after the first one
+ const newDeadline = new anchor.BN(Math.floor(Date.now() / 1000) + 24*7*60*60); // 1 week from now
+ await program.methods.setDeadline(newDeadline).accounts({
+ fund: fundPDA,
+ creator: creator.publicKey,
+ }).rpc();
+
+ const fund = await program.account.fund.fetch(fundPDA);
+ console.log("fundDeadline after second set", fund.deadline);
+
+ // Set deadline again after the second one
+ // set back to 10 second from now again (first value from the test)
+ await program.methods.setDeadline(deadline).accounts({
+ fund: fundPDA,
+ creator: creator.publicKey,
+ }).rpc();
+
+ const fundAfter = await program.account.fund.fetch(fundPDA);
+ console.log("fundDeadline after third set", fundAfter.deadline);
+ });
+
it("Contributes to fund", async () => {
// Generate PDA for contribution
[contributionPDA, contributionBump] = await PublicKey.findProgramAddress(
then run anchor test the result would show the deadline changes:
fundDeadline after second set <BN: 67e95283>
fundDeadline after third set <BN: 67e0180c>
✔ PoC: Sets a deadline multiple times (811ms)
Impact
creator can extend their deadline multiple times, confusing and deceiving user
Tools Used
manual review
Recommendations
properly set the flag deadline_set to true after set_deadline are called first time
Updates
Appeal created
bube 3 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.