RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incomplete Deadline Validation

mayc

Summary

The deadline validation mechanism is incomplete, allowing potentially invalid deadlines.

Vulnerability Details

The function set_deadline does not have a mechanism to prevent setting deadlines in the past.

Impact

The owner of the Fund caling set_deadline will have the ability to set a deadline in the past. This will block the contribute function, because the deadline check will show, that the fund is not active returning error DeadlineReached

Tools Used

  • Foundry Tests: By writing a test where I set a deadline in the past.

  • Manual Code Review: Identified missing checks in the function set_deadline.

Recommendations

  • Additional deadline check which verifies that the deadline is not in the past.

  • New error code ErrorCode::InvalidDeadlineInput which will be returned when the check is triggered.

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
if deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::InvalidDeadlineInput.into());
}
fund.deadline = deadline;
Ok(())
}
Updates

Appeal created

bube Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Lack of validation of the `deadline` parameter in `set_deadline` function

The creator has an incentive to pay attention to the deadline and provide correct data. If the `deadline` is set in the past, the campaign will be completed. If there are any funds the creator or the contributors (depending on the success of the campaign) can receive them. It is the creator's responsibility to set correct deadline, otherwise the creator can create a new campaign. There is no impact on the protocol from this missing check, so I consider this to be an informational issue.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.