Submission Details
Severity:
Typo in Fund Struct Field
Summary
The set_deadline function allows setting deadlines in the past.
Vulnerability Details
No validation ensures the deadline is in the future, allowing immediate expiration of the fund.
Impact
A creator could set an already-passed deadline, preventing contributions or enabling immediate withdrawals/refunds, potentially maliciously.
Tools Used
Manual Code Review
Recommendations
Add validation:
let current_time = Clock::get()?.unix_timestamp.try_into().unwrap();
if deadline <= current_time {
return Err(ErrorCode::DeadlineReached.into());
}
Updates
Appeal created
bube 3 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
[Invalid] Wrong naming of `deadline_set`
This is strong informational finding, there is no impact for the protocol. The variable is the same on all places.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.