Rust Fund

Description

The set_deadline function (lines 55-63) checks if fund.dealine_set on line 57 to prevent the deadline from being changed. However, the function never sets fund.dealine_set = true after setting the deadline.

pub fn set_deadline(ctx: Context, deadline: u64) -> Result<()> {
let fund = &mut ctx.accounts.fund;
if fund.dealine_set {
return Err(ErrorCode::DeadlineAlreadySet.into());
}
fund.deadline = deadline;
// Missing: fund.dealine_set = true;
Ok(())
}

Risk

Since dealine_set starts as false (line 20) and is never changed to true, the creator can call set_deadline an unlimited number of times. This allows a malicious creator to:

1. Set a short deadline to attract contributors

2. As the deadline approaches and the goal isn't met, extend the deadline

3. Repeat indefinitely, preventing contributors from ever getting refunds

4. Wait until enough contributions accumulate, then withdraw (since withdraw has no checks)

Proof of Concept

1. Creator creates fund, sets deadline to 7 days

2. Contributors contribute SOL expecting a 7-day campaign

3. On day 6, creator calls set_deadline with 30 days — succeeds because dealine_set is still false

4. Contributors cannot refund because the new deadline hasn't passed

5. Creator extends deadline again on day 29

6. This cycle can continue forever

Mitigation

Add the missing flag update:

fund.deadline = deadline;
fund.dealine_set = true;