Rust Fund

Summary

set_deadline performs no deadline > now check, so the creator can set an already-passed deadline and instantly flip the campaign into the refund phase.

Root Cause

In set_deadline() (programs/rustfund/src/lib.rs), the new deadline is stored without validating it against Clock::get().unix_timestamp. A past timestamp is accepted silently.

Impact

Low severity / Low likelihood: requires the creator to act against their own campaign; instantly opens the refund path (per M-2's lifecycle break) and can surprise contributors mid-raise.

PoC

Call set_deadline(yesterday) → succeeds; the campaign is immediately in the post-deadline phase. (Verified by code inspection.)

Mitigation

Add require!(deadline > Clock::get().unwrap().unix_timestamp, InvalidDeadline); in set_deadline().

Review notes

Access control on privileged fns (has_one = creator + Signer) and checked math on the transfers themselves were verified sound.