RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

The set_deadline function lacks proper access control

2ace

Summary

The set_deadline function lacks proper access control, allowing any user to call it and modify the deadline before the creator sets it.

Vulnerability Details

1.A malicious user interacts with the contract and calls set_deadline().

2.Since no ownership or role-based checks exist, the function executes successfully, changing the deadline value.

3.This results in arbitrary changes to contract behavior.

Impact

Medium because of low likelihood but impact is high.

Tools Used

Manual.

Recommendations

Implement access control to restrict this function to authorized users ie. Creator. Should be the only one to set deadline.

​
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
​
@> if fund.creator != ctx.accounts.creator.key();{
return Err(ErrorCode::Unauthorized.into());
}
​
​
​
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
Ok(())
}
​
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[Invalid] Lack of access control in `set_deadline` function

There is no need for additional checks of the caller's key inside the `set_deadline` function because Anchor verifies the `has_one = creator` constraint before executing the function. This ensures that the creator field inside the fund account must match the creator (signer) passed to the function: ``` #[account(mut, has_one = creator)] pub fund: Account<'info, Fund> ``` If they don’t match, the transaction fails. Also, signer verification is included: ``` #[account(mut)] pub creator: Signer<'info>, ``` The creator account must be a signer, meaning the transaction must be signed using the creator's private key.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.