Submission Details
Severity:
Missing Deadline Flag Update in `set_deadline`
Summary: The dealine_set flag is never updated when setting a deadline
Vulnerability Details: In the set_deadline function, the code checks if dealine_set is true to prevent changing the deadline multiple times, but it never actually sets this flag to true after setting the deadline
Impact: This allows the fund creator to change the deadline multiple times, which could be exploited to manipulate the campaign. For example, if a campaign is failing, the creator could extend the deadline indefinitely
Tools Used: Code review
Recommendations:
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
fund.deadline_set = true;
Ok(())
}
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.