Submission Details
Severity:
The `set_deadline` instruction does not set `deadline_set` to true, enables fundraising duration to change after getting initialised once
Summary
The set_deadline_ function sets the deadline field of_ Fund account. It does not set the deadline_set field to true. This makes it possible to set the deadline once again after being initialised since the condition will evaluate to true.
Vulnerability Details
The function does not set the deadline_set field to true, which enables the deadline to be initialised once again.
Impact
User can set the deadline duration of the project once again.
Recommendations
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.deadline_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
+ fund.deadline_set = true;
fund.deadline = deadline;
Ok(())
}
Updates
Appeal created
bube 3 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.