Summary

The set_deadline() function is designed to allow the creator to set a deadline for their fundraising campaign. However, the logic does not enforce a restriction that prevents the creator from changing the deadline once it has been set. Specifically, the flag dealine_set is not updated to reflect that a deadline has been established. This oversight means that the creator can repeatedly call set_deadline() to change the deadline, potentially manipulating the fundraising process.

Vulnerability Details

In the rustfund smart contract, the functionality for managing fundraising campaigns includes the ability for the creator to set a deadline for contributions through the set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) function. This function checks if the deadline has already been set by evaluating the dealine_set flag. If the flag is false, the function allows the creator to set a new deadline. However, the current implementation does not update the dealine_set flag to true after the deadline is established, which allows the creator to reset the deadline multiple times.

The relevant components involved in this functionality include:

• The Fund struct, which contains the deadline and dealine_set fields.

• The set_deadline() function, which is responsible for setting the deadline for a fundraising campaign.

The root cause of the issue lies in the logic of the set_deadline() function, specifically in the following code snippet:

Since the dealine_set flag is not updated after setting the deadline, the creator can repeatedly call set_deadline() to change the deadline, potentially leading to abuse of the fundraising mechanism. This could allow the creator to extend the deadline indefinitely, manipulating the campaign's timeline to their advantage.

Impact

The ability for the creator to reset the deadline can lead to significant abuse of the crowdfunding mechanism, undermining the trust and transparency that the platform aims to provide. This could result in contributors being misled about the campaign's timeline and potentially losing confidence in the platform.

Tools Used

Manual Review

Recommendations

To mitigate this issue, the set_deadline() function should be updated to set the dealine_set flag to true after the deadline is established. This will prevent the creator from resetting the deadline once it has been set. The following code change is recommended: