RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Deadline Flag Not Updated Allows Multiple Deadline Changes

0xsalami

Summary

The rustfund program fails to properly protect against multiple deadline changes due to an incomplete implementation of the set_deadline function. While the function checks if a deadline has already been set, it never updates the flag indicating a deadline has been set, allowing fund creators to change deadlines multiple times and potentially manipulate the campaign timing.

Vulnerability Details

The set_deadline function allows a fund creator to set a deadline for the campaign. The function includes a check to determine if the deadline has already been set by examining the dealine_set flag

if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}

However, after setting the deadline value, the function fails to update the dealine_set flag to true. This omission means that the check will always evaluate to false, allowing fund creators to repeatedly modify the deadline by calling the function multiple times.

Impact

Refund Timing Exploitation: By changing deadlines, creators could prevent contributors from claiming refunds by continually extending the deadline before it's reached.

Tools Used

Manual Review

Recommendations

Update the set_deadline function to set the flag after setting the deadline

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
+ fund.dealine_set = true; // Add this line
Ok(())
}
Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deadline set flag is not updated in `set_deadline` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.