Submission Details
Severity:
Title: Deadline Can Be Set Multiple Times
Summary
The set_deadline function is missing an essential update: it does not set dealine_set = true, which allows the deadline to be modified multiple times.
Vulnerability Details
The function checks if
dealine_setistruebefore proceeding, but it never updatesdealine_set = trueafter setting the deadline.This means the check is ineffective, and the deadline can be modified indefinitely.
Impact
A campaign owner can continuously change the deadline, misleading contributors and preventing them from withdrawing refunds.
Tools Used
Manual code review.
Recommendations
Ensure dealine_set = true after setting the deadline
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
fund.dealine_set = true; // ✅ Fix: Mark deadline as set
Ok(())
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.