Submission Details
Severity:
Contribution Before Deadline Set in RustFund Contract
Summary
Contributions are allowed when deadline = 0, which may not qualify as an "active campaign."
Vulnerability Details:
The vulnerable code is in the contribute function:
rust
if fund.deadline != 0 && fund.deadline < Clock::get().unwrap().unix_timestamp.try_into().unwrap() {
return Err(ErrorCode::DeadlineReached.into());
}
No Restriction: deadline = 0 allows contributions.
Impact:
Logic Disruption: Funding before campaign terms are set.
Tools Used: Manual Review
Recommendations:
Require deadline:
rust
if fund.deadline == 0 {
return Err(ErrorCode::DeadlineNotSet.into());
}
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
[Invalid] Contributions are allowed before the deadline is initialized.
There is no problem users to contribute to a given campaign before the deadline is initialized. The issue is when the users refund before the deadline is set.
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.