RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Deadline Validation Weakness in RustFund Contract

osuolale

Summary

The set_deadline function accepts any u64 value without validation, allowing past or unrealistic deadlines.

Vulnerability Details

The vulnerable code is in the set_deadline function:

rust

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
Ok(())
}

  • No Validation: Accepts deadline < current_time or excessively large values.

Impact

  • Logic Disruption: Past deadlines cause immediate failure; huge deadlines delay resolution indefinitely.

  • User Experience: Poor campaign management.

Tools Used

Manual Review

Recommendations

Validate deadline:

rust

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
let current_time = Clock::get()?.unix_timestamp.try_into().unwrap();
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
if deadline <= current_time {
return Err(ErrorCode::InvalidDeadline.into());
}
fund.deadline = deadline;
Ok(())
}

Add new error code:

rust

#[error_code]
pub enum ErrorCode {
// ... existing errors ...
#[msg("Deadline must be in the future")]
InvalidDeadline,
}
Updates

Appeal created

bube Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[Invalid] Lack of validation of the `deadline` parameter in `set_deadline` function

The creator has an incentive to pay attention to the deadline and provide correct data. If the `deadline` is set in the past, the campaign will be completed. If there are any funds the creator or the contributors (depending on the success of the campaign) can receive them. It is the creator's responsibility to set correct deadline, otherwise the creator can create a new campaign. There is no impact on the protocol from this missing check, so I consider this to be an informational issue.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.