RustFund

Summary

The contribute function does not prevent contributions when no deadline is set (i.e., deadline == 0). This allows funds to be contributed even though the campaign deadline hasn't been established, contrary to the intended logic.

Vulnerability Details

In the contribute function, the check for deadline expiry is implemented as:

This condition only evaluates to true if a deadline is set (non-zero). However, if the deadline is not set (deadline == 0), the condition fails, and contributions are allowed. This behavior conflicts with the desired logic where contributions should only be accepted after a valid deadline is established. Utilizing the fund.dealine_set flag would allow the contract to enforce that contributions cannot be made until the deadline is explicitly set.

Impact

Funds may be contributed to campaigns without a proper deadline, leading to potential misuse or mismanagement of funds.

• It can result in unpredictable behavior regarding campaign closure, refunds, and fund withdrawals.

• This flaw may compromise the overall trust and security of the crowdfunding platform.

Tools Used

• Static analysis of contract logic

• Manual code review

Recommendations

• Modify the contribute function to include a check for the fund.dealine_set flag before allowing contributions. For example:

• Update the ErrorCode enum to include a new error for unset deadlines (e.g., DeadlineNotSet).

• Implement thorough unit testing to verify that contributions are only accepted when a deadline has been explicitly set.