Lack of funding goal and deadline check in withdraw function
Summary:
Hi,
I have found out a potential bug in which the withdraw function of the smart contract doesn't check the funding goal achieved or deadline in withdraw function.
Vulnerability Details:
The key details of this potential vulnerability are given as follows:
withdraw function doesn't check if funding goal has been met or deadline has passed before allowing the creator to withdraw funds.
Impact:
Creator can withdraw funds at any time, even if campaign is ongoing or unsuccessful.
Tools Used:
Manual review
Recommendations:
Add checks in withdraw function as follows:
For goal met:
fund.amount_raised >= fund.goalFor deadline passed:
fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap()
Appeal created
No deadline check in `withdraw` function
No goal achievement check in `withdraw` function
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.