Submission Details
Severity:
Missing update to `dealine_set` in `set_deadline` function
Summary
Missing update to dealine_set in set_deadline function.
Vulnerability Details
The set_deadline function checks if the deadline is already set but doesn't update the flag after setting it:
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
// Missing: fund.dealine_set = true;
Ok(())
}
Impact
In function set_deadline, it checks if dealine_setis true before allowing the dealine to be set. This means dealine_setcan be called once. However, after setting the deadline, the function never updates the dealine_set flag to true . The fund creator can call set_deadline multiple times, changing the deadline at will.
Tools Used
VSCode
Recommendations
fund.deadline = deadline;
fund.deadline_set = true;
Ok(())
Updates
Appeal created
bube 6 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.