Submission Details
Severity:
Immediate Refunds risk
Summary : Immediate Refunds Allowed if Deadline Is Not Set in fund_create allowing refunds to be claimed immediately.
Vulnerability Details: In the refund function, if the deadline is not set (i.e., deadline = 0), the condition deadline > current_time fails, allowing refunds to be claimed immediately. This may not align with the intended behavior where refunds should only be possible after a certain period.
Impact - Contributors can claim refunds at any time if the deadline is not set, potentially disrupting the funding process.
This could lead to
fundsbeingwithdrawnprematurely, affecting the fund’s ability to reach its goal.
Recommendations
+ Modify the refund logic to prevent refunds if the deadline is not set or has not passed.
+ if fund.deadline == 0 || fund.deadline > current_time { return Err(ErrorCode::DeadlineNotReached.into());}
Updates
Appeal created
bube 8 months ago
Submission Judgement Published Assigned finding tags:
Possible refund before the deadline is initialized
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.