RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`dealine_set` is not updated in the deadline setting function

iamthesvn

Summary

The set_deadline function fails to update the dealine_set flag to true after setting the deadline value. This creates a state inconsistency that could lead to multiple deadline changes despite program logic intended to prevent this behavior.

Vulnerability Details

The function does check initially if the deadline is already set or not via the following code, correctly returning an error if a deadline has already been set.:

if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}

But if the dealine_set flag is never set to true after the fund creator sets the deadline, he/she has the liberty to change the deadline practically whenever they want to and hence disrupting the functioning of the protocol.

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline; // @audit creator can change the deadline whenever they want to
Ok(())
}

Impact

This vulnerability allows the fund creator to call set_deadline multiple times, changing the deadline value repeatedly. The creator could extend the deadline indefinitely when fundraising is slow.

Tools Used

Manual Review

Recommendations

Update the set_deadline flag after setting the deadline:

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
fund.dealine_set = true; // Add this line to update the flag
Ok(())
}
Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deadline set flag is not updated in `set_deadline` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.