Summary

The function validates that the deadline is in the future but doesn’t enforce an upper limit, potentially allowing deadlines far beyond reasonable use cases.

Vulnerability Details

Fund creator sets deadline = u64::MAX;

Contributors might not realize the fund is effectively permanent.

Impact

Contributors can never get refunds because the creator set a deadline that's unrealistic and the goal will never be reached in many scenarios.

Tools Used

Manual review

Recommendations

Add an upper bound (e.g., 1 year from now).

`let clock = Clock::get()?;

let max_deadline = clock.unix_timestamp as u64 + 31_536_000; // ~1 year

require!(deadline <= max_deadline, ErrorCode::DeadlineTooFar);`