RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Creator may reset deadline freely because 'dealine_set' is never set to true

chrissavov

Summary

dealine_set in the Fund struct is used for the set_deadline() in order for the creator to not be able reset the deadline. However, this variable is never set to true anywhere in the code.

Note that there is a typo in dealine_set. It should be deadline_set. This is however not a inherent problem with the code logic as it is written the same way everywhere in the code.

Vulnerability Details

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
@> //@audit should change dealine_set to true.
Ok(())
}

set_deadline() reverts if dealine_set == true. However, it is never set to true after fund.deadline gets a value. This allows the creator to call the function as he wishes and change the deadline.

POC

Add the following test "Sets a second deadline" after the "Sets a deadline" test provided by the devs:

it("Sets a deadline", async () => {
await program.methods
.setDeadline(deadline)
.accounts({
fund: fundPDA,
creator: creator.publicKey,
})
.rpc();
​
const fund = await program.account.fund.fetch(fundPDA);
console.log("fundDeadline", fund.deadline);
});
​
+ it("Sets a second deadline", async () => {
+ await program.methods
+ .setDeadline(new anchor.BN(Math.floor(Date.now() / 1000) + 20))
+ .accounts({
+ fund: fundPDA,
+ creator: creator.publicKey,
+ })
+ .rpc();
++ const fund = await program.account.fund.fetch(fundPDA);
+ console.log("fundDeadline", fund.deadline);
+
+ });

Normally it should revert, but in passes with the vulnerability present in the code:

fundDeadline <BN: 67e3c31c>
✔ Sets a deadline (403ms)
fundDeadline <BN: 67e3c327>
✔ Sets a second deadline (406ms)

Impact

Undermines contributors trust as the creator can always delay the project.

Tools Used

Manual review, anchor tests

Recommendations

Set dealine_set == true once the deadline is set.

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
+ fund.dealine_set = true;
Ok(())
}
Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deadline set flag is not updated in `set_deadline` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.