Submission Details
Impact:
Likelihood:
No validation that deadline > current time allows creator to lock contributions immediately
Root + Impact
Description
-
Describe the normal behavior in one or more sentences
-
Explain the specific issue or problem in one or more sentences
# Finding 3: set_deadline() accepts past timestamps
**Severity:** Medium
**Title:** No validation that deadline > current time allows creator to lock contributions immediately
## Description
The `set_deadline()` instruction (`lib.rs:55-63`) sets the campaign deadline variable without validating if the provided timestamp is in the future. Because there is no chronological order check, a creator can pass a timestamp from the past or the exact current block time. This causes the campaign to immediately flag as expired.
## Impact
A malicious or negligent creator can permanently brick their own crowdfunding campaign. Any subsequent user attempts to invoke `contribute()` will instantly fail with a `DeadlineReached` error, creating an accidental denial-of-service state.
## Proof of Concept
This timeline trace shows how a creator can manipulate the deadline parameter to lock out contributions:
1. Creator deploys a funding campaign using the `fund_create()` instruction.
2. Creator immediately invokes `set_deadline()` and passes an expired Unix timestamp (or current cluster time).
3. Any user trying to deposit funds via `contribute()` hits the expired timestamp guard and gets blocked.
```rust
// Creator sets the campaign expiration to a timestamp in the past
set_deadline(fund, deadline = 1700000000)
// User calls contribute() afterwards, which automatically reverts
contribute(fund, contributor = victim, amount = 5 * LAMPORTS_PER_SOL)
// Transaction fails with ErrorCode::DeadlineReached
```
## Recommended Mitigation
This mitigation adds a real-time validation check using the cluster clock runtime state to ensure that only future expiration parameters can be stored.
Integrate a timestamp constraint checking mechanism against the current `Clock` sysvar inside the instruction handler:
```rust
pub fn set_deadline(ctx: Context<FundSetDeadline>, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
require!(!fund.dealine_set, ErrorCode::DeadlineAlreadySet);
// Fetch cluster time and enforce future parameter values
let current_time = Clock::get().unwrap().unix_timestamp as u64;
require!(deadline > current_time, ErrorCode::InvalidDeadline);
fund.deadline = deadline;
fund.dealine_set = true;
Ok(())
}
```
Risk
Likelihood:
-
Reason 1 // Describe WHEN this will occur (avoid using "if" statements)
-
Reason 2
Impact:
-
Impact 1
-
Impact 2
Proof of Concept
Recommended Mitigation
- remove this code
+ add this code
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.