Submission Details
Severity:
Creator can change deadline multiple times
Summary
The deadline_set field in the Fund Account is always false even when the deadline is set in set_deadline.
Vulnerability Details
This entails that there is that the creator can change the deadline multiple times at will
Impact
Creator can change deadline multiple times to cheat contributors who contributed at an initial deadline, hence allowing more contributions until the goal is met
Tools Used
Manual
POC
Check deadline_set after set_deadline is called.
Add this in rustfund.ts#L64
console.log("deadline_set = ", fund.dealineSet);// This ooutputs false
Recommendations
Ensure that the deadline_set is true after the set_deadline is called.
Add in set_deadline
fund.dealine_set = true;
Updates
Appeal created
bube 2 months ago
Submission Judgement Published Assigned finding tags:
Deadline set flag is not updated in `set_deadline` function
Rewards breakdown
nSLOC
170This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.