Submission Details
Impact:
Likelihood:
Deadline of zero bypasses the contribution deadline guard, enabling contributions to un-set campaigns
Root + Impact
Description
-
Describe the normal behavior in one or more sentences
-
Explain the specific issue or problem in one or more sentences
# Finding 5: deadline=0 bypasses contribution deadline check
**Severity:** Medium
**Title:** Deadline of zero bypasses the contribution deadline guard, enabling contributions to un-set campaigns
## Description
In `contribute()` (`lib.rs:29-31`), the contract validates timeline restrictions using a non-zero initialization check: `if fund.deadline != 0 && fund.deadline < Clock::get()...`. However, fresh campaigns initialized via `fund_create` store `deadline = 0` by default. Because the logic explicitly skips verification when the state equals zero, users are permitted to deposit funds into unconfigured campaigns that have no end date or parameters enforced.
## Impact
Contributors can inadvertently deposit assets into unconfigured pools before proper project tracking thresholds are locked into the state. This logic gap directly supports capital drain vectors where creators collect funds before defining project execution milestones.
## Proof of Concept
This workflow trace demonstrates how users can interact with an unconfigured campaign state:
1. A creator initializes a new fund account without supplying timeline variables (`deadline` defaults to 0).
2. A user attempts a deposit; the contract skips timeline validation because `fund.deadline != 0` evaluates to false.
3. The transaction succeeds and user assets flow into a contract that lacks valid operational limits.
```rust
// 1. Campaign is initialized with an unconfigured zero deadline
fund_create(name="ZeroDeadlineCampaign", goal=50 * LAMPORTS_PER_SOL)
// 2. Contributor calls deposit; zero check allows entry without restrictions
contribute(fund, contributor=victim, amount=10 * LAMPORTS_PER_SOL)
// Transaction executes successfully despite missing configuration parameters
```
## Recommended Mitigation
This mitigation applies state checks to guarantee that campaign parameters are locked before any user funds can be deposited.
Update the `contribute` instruction to enforce an active, initialized campaign deadline:
```rust
pub fn contribute(ctx: Context<FundContribute>, amount: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
// Enforce that a non-zero campaign timeline has been configured
require!(fund.deadline != 0, ErrorCode::DeadlineNotSet);
// Enforce that the active campaign has not expired
let current_timestamp = Clock::get().unwrap().unix_timestamp as u64;
require!(fund.deadline > current_timestamp, ErrorCode::DeadlineReached);
// Proceed with existing deposit logic...
Ok(())
}
```
Risk
Likelihood:
-
Reason 1 // Describe WHEN this will occur (avoid using "if" statements)
-
Reason 2
Impact:
-
Impact 1
-
Impact 2
Proof of Concept
Recommended Mitigation
- remove this code
+ add this code
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.