Submission Details
Severity:
Missing Deadline Check in withdraw
Summary
The withdraw function allows the creator to withdraw funds at any time without checking the deadline.
Vulnerability Details
There’s no validation in withdraw to ensure the deadline has passed or been unset (deadline == 0) before allowing funds to be withdrawn, which might not align with crowdfunding expectations.
Impact
Creators can withdraw funds prematurely, potentially undermining trust in the fundraising system.
Tools Used
Manual Code Review
Recommendations
Add a deadline check:
if fund.deadline != 0 && fund.deadline > Clock::get()?.unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineNotReached.into());
}
Updates
Appeal created
bube 3 months ago
Submission Judgement Published Assigned finding tags:
No deadline check in `withdraw` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.