RustFund
First Flight #36
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing State Update in set_deadline

truthixify

Summary

The set_deadline function in the rustfund program fails to set the dealine_set flag to true after assigning a deadline. This oversight allows unauthorized modifications to the deadline, potentially undermining the integrity of the crowdfunding process.

Vulnerability Details

In the set_deadline function, the following logic is implemented:

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
​
fund.deadline = deadline;
Ok(())
}

The function checks whether the deadline has already been set using the dealine_set flag. However, after setting the deadline, the flag is not updated to true. As a result, the creator can repeatedly call this function to modify the deadline, leading to potential manipulation of the crowdfunding process.

Impact

  • Unauthorized modification of the fundraising deadline, potentially extending or shortening the campaign duration unfairly.

  • Compromised trustworthiness of the crowdfunding process, affecting contributors’ confidence.

  • Potential abuse by the fund creator to extend deadlines indefinitely, exploiting contributors’ funds.

Tools Used

  • Manual code review

  • Analysis of control flow in the set_deadline function

Recommendations

To address this vulnerability, update the set_deadline function to correctly set the dealine_set flag to true after setting the deadline:

pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
​
fund.deadline = deadline;
fund.dealine_set = true; // Properly set the flag
Ok(())
}
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Deadline set flag is not updated in `set_deadline` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.