RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing Access Control in set_deadline() Function, allowing any user to update the fund deadlines

ashishlach

Summary

The set_deadline() function lacks proper access control, allowing any user to modify the deadline of a fundraising campaign. This can lead to unauthorized changes in the timeline of the fund, impacting contributors and the fund creator.

Vulnerability Details

The function does not verify whether the caller is the fund creator before setting the deadline. Any malicious actor can override the deadline, leading to potential abuse such as setting an extremely short or long duration, disrupting the intended fundraising process.

https://github.com/CodeHawks-Contests/2025-03-rustfund/blob/b5dd7b0ec01471667ae3a02520701aae405ac857/programs/rustfund/src/lib.rs#L55

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
//@audit - no check if creator is same as fund creator
fund.deadline = deadline;
Ok(())
}

Impact

  • Leading to loss of trust from contributors. Attackers could set an extremely short deadline making refunds impossible

Tools Used

Manual Review

Recommendations

Ensure only the creator can set the deadline

require_keys_eq!(fund.creator, ctx.accounts.creator.key(), ErrorCode::UnauthorizedAccess);
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[Invalid] Lack of access control in `set_deadline` function

There is no need for additional checks of the caller's key inside the `set_deadline` function because Anchor verifies the `has_one = creator` constraint before executing the function. This ensures that the creator field inside the fund account must match the creator (signer) passed to the function: ``` #[account(mut, has_one = creator)] pub fund: Account<'info, Fund> ``` If they don’t match, the transaction fails. Also, signer verification is included: ``` #[account(mut)] pub creator: Signer<'info>, ``` The creator account must be a signer, meaning the transaction must be signed using the creator's private key.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.