RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Logic in set_deadline() Allows multiple updates on deadline variable

ashishlach

Summary

The set_deadline() function checks whether fund.dealine_set is true before allowing the deadline to be updated. However, it fails to update fund.dealine_set after setting the deadline, allowing multiple calls to update the deadline indefinitely.

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
​
fund.deadline = deadline;
//@audit - bug fund.dealine_set should be set here
Ok(())
}
​
​
​

Vulnerability Details

The function checks if dealine_set is already true, but it does not mark it as true after setting the deadline:

https://github.com/CodeHawks-Contests/2025-03-rustfund/blob/b5dd7b0ec01471667ae3a02520701aae405ac857/programs/rustfund/src/lib.rs#L55

Since fund.dealine_set is never updated, users can repeatedly call set_deadline(), modifying the deadline at any time, even after contributions have been made. This can be exploited by the fund creator to adjust deadlines strategically and manipulate withdrawals.

Impact

Fund creators can repeatedly update the deadline, allowing them to withdraw funds at their convenience.

Users may be misled about the deadline, as it can change arbitrarily.

Fundraising integrity is compromised, making deadlines meaningless.

Tools Used

Manual review

Recommendations

Update fund.dealine_set to true after setting the deadline to enforce one-time modification. This ensures that once a deadline is set, it cannot be changed, maintaining fundraising integrity.

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
​
fund.deadline = deadline;
//@audit
+ fund.dealine_set = true
Ok(())
}
​
​
​
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deadline set flag is not updated in `set_deadline` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.