Submission Details
Severity:
Deadline Flag Never Set
Summary
The contract checks for a flag that prevents setting multiple deadlines, but it never actually sets this flag.
Vulnerability Details
In the set_deadline function, the contract checks the dealine_set flag to prevent setting the deadline multiple times, but after setting the deadline, it never updates this flag to true. This means the check is ineffective, and deadlines can be changed multiple times.
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
// Missing: fund.dealine_set = true;
Ok(())
}
Impact
Fund creators can change the deadline multiple times, creating confusion for contributors and potentially manipulating the funding timeline
POC
//audit MEDIUM - Deadline Never Marked as Set
it("Can set multiple deadlines despite check", async () => {
const firstDeadline = new anchor.BN(Math.floor(Date.now() / 1000) + 100);
await program.methods
.setDeadline(firstDeadline)
.accounts({
fund: fundPDA,
creator: creator.publicKey,
})
.rpc();
ā
const secondDeadline = new anchor.BN(Math.floor(Date.now() / 1000) + 200);
await program.methods
.setDeadline(secondDeadline)
.accounts({
fund: fundPDA,
creator: creator.publicKey,
})
.rpc();
ā
const fund = await program.account.fund.fetch(fundPDA);
console.log(`Set deadline twice. New deadline: ${fund.deadline.toString()}`);
});
Output:
========================================
š BUG REPORT [MEDIUM]: Deadline Flag Never Set
----------------------------------------
Description: The dealine_set flag is checked but never set to true after setting a deadline
Evidence: Successfully set deadline multiple times. New deadline: 1742920083
========================================
Tools Used
Anchor framework for testing
Manual code review
Recommendations
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
+ fund.dealine_set = true; // Add this line
Ok(())
}
Updates
Appeal created
bube 8 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.