Submission Details
Severity:
Missing Deadline Enforcement
Summary
Campaigns can operate without a deadline due to initialization to 0.
Vulnerability Details
The fund_create initializes deadline to 0, and there's no enforcement to set it later.
Impact
Creators could create perpetual campaigns that never conclude, blocking refunds and withdrawals.
Tools Used
Manual code review
Recommendations
Require deadline at creation
Or add deadline check in contribute
if fund.deadline == 0 {
return Err(ErrorCode::DeadlineNotSet.into());
}
Updates
Appeal created
bube 5 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
[Invalid] Contributions are allowed before the deadline is initialized.
There is no problem users to contribute to a given campaign before the deadline is initialized. The issue is when the users refund before the deadline is set.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.