Summary

The set_deadline function lacks basic input sanitization checks. Assuming that the other issues that I reported will be fixed, this can be problematic because a creator can set the deadline at a timestamp that's in the past, or it can be set to zero or at a point that is too far in the future.

Vulnerability Details

Each scenario poses different risks. I'll lay them out here in order of severity:

1. setting the timestamp in the past -> it will appear as if the Campaign already ended. This will completely DoS the campaign, the Creator will DoS themselves.

2. setting the timestamp too far in the future -> user's funds will be locked in the contract for a very long time.

3. setting the timestamp to zero -> Because of this check if fund.deadline != 0 that's present in both contribute and refund functions, the campaign will effectively never have a deadline. Users will be able to call contribute, but they will never be able to call refund because this 2nd check will never be true in this case ctx.accounts.fund.deadline > Clock::get().unwrap().unix_timestamp.try_into().unwrap(). Assuming the withdraw function will be fixed, the Creator will also be unable to withdraw the tokens. Whoever sends funds to this campaign will have them locked.

Impact

Depending on the scenario that we land in, the impact ranges from Low -> High, but considering that the Creator must make a mistake and this is an important precondition, I think this can be given Low severity.

Tools Used

Manual review

Recommendations

Enforce a deadline that:

• can not be zero

• must be in the future

• add a cap so that it is not too far in the future (let's say 2-4 weeks for a campaign)