RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unenforced Deadline in set_deadline Allows Zero Value

rare__one

Summary

The set_deadline function in lib.rs does not enforce a minimum or non-zero value for the deadline field, and the default value in fund_create is 0. This allows a fund to operate without an effective deadline, undermining the contract’s timing-based logic (e.g., refunds and withdrawals).

Vulnerability Details

Location:

  • fund_create: fund.deadline = 0

  • set_deadline: No validation on deadline parameter

  • contribute and refund: Deadline checks treat 0 as “no deadline set.”

  • Description:

    • In contribute, the check if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp allows contributions when deadline = 0.

    • In refund, the check if fund.deadline != 0 && fund.deadline > Clock::get().unwrap().unix_timestamp allows refunds when deadline = 0, regardless of time.

    • This effectively disables the deadline mechanism if not explicitly set or set to 0.

Impact

Unexpected Behavior: Contributors can add funds and request refunds at any time if the deadline remains 0, bypassing the intended expiration logic.

  • Creator Advantage: The creator could withdraw funds via withdraw without a deadline constraint, potentially before the goal is met.

  • User Trust: Lack of enforced timing could confuse or mislead users expecting a deadline-based crowdfunding model.

Tools Used

Manual Code Review: Identified by analyzing deadline-related logic across functions.

Recommendations

Enforce Non-Zero Deadline: Add validation in set_deadline to reject 0 or values in the past

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let current_time = Clock::get().unwrap().unix_timestamp.try_into().unwrap();
if fund.deadline_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
if deadline <= current_time {
return Err(ErrorCode::InvalidDeadline.into()); // Add new error code
}
fund.deadline = deadline;
fund.deadline_set = true; // Ensure this is set
Ok(())
}

Update Error Enum: Add InvalidDeadline:

#[error_code]
pub enum ErrorCode {
// ... other errors ...
#[msg("Deadline must be in the future")]
InvalidDeadline,
}
Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Lack of validation of the `deadline` parameter in `set_deadline` function

The creator has an incentive to pay attention to the deadline and provide correct data. If the `deadline` is set in the past, the campaign will be completed. If there are any funds the creator or the contributors (depending on the success of the campaign) can receive them. It is the creator's responsibility to set correct deadline, otherwise the creator can create a new campaign. There is no impact on the protocol from this missing check, so I consider this to be an informational issue.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.