RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Deadline Validation Allows Past Dates

edoscoba

Summary

The RustFund contract does not validate whether a campaign's deadline is set in the future. This allows a creator to set a deadline in the past, which can result in instant expiration, unfairly preventing contributions or immediately triggering refund conditions.

Vulnerability Details

Currently, when a campaign creator sets a deadline, there is no validation ensuring that the deadline is later than the current blockchain timestamp. This means a creator can mistakenly set a deadline that has already passed.

Example Scenario:

  1. A creator launches a campaign and sets the deadline to a past timestamp (e.g., yesterday).

  2. The campaign is immediately marked as expired, even though no contributions have been made.

Problematic Code

pub fn set_deadline(ctx: Context<SetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
fund.deadline = deadline; // No validation if deadline is in the future
Ok(())
}
​

Impact

Instant Campaign Expiry: Contributors may attempt to fund campaigns that are already expired, leading to failed transactions.

  • Unfair Refund Triggering: Malicious creators could trigger refund conditions immediately to manipulate funds.

Tools Used

Manual Code Review

Recommendations

Enforce Future Deadlines: Modify the set_deadline function to validate that the deadline is greater than the current blockchain timestamp.

require!(deadline > Clock::get()?.unix_timestamp as u64, CustomError::InvalidDeadline);
Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Lack of validation of the `deadline` parameter in `set_deadline` function

The creator has an incentive to pay attention to the deadline and provide correct data. If the `deadline` is set in the past, the campaign will be completed. If there are any funds the creator or the contributors (depending on the success of the campaign) can receive them. It is the creator's responsibility to set correct deadline, otherwise the creator can create a new campaign. There is no impact on the protocol from this missing check, so I consider this to be an informational issue.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.