Submitted by adeolu
There is no check for if the renting_period is within the rentals available period (token.shortterm_rental.available_period). This means that reservations can be made to rent the property on dates outside its available period.
Property managers/landlords can list a property via setlistforshorttermrental() and setlistforshorttermrental(). In both of these functions, the parameter available_period is accepted and is set into the rental tokens struct in storage as seen below:
https://github.com/code-423n4/2024-10-coded-estate/blob/97efb35fd3734676f33598e6dff70119e41c7032/contracts/codedestate/src/execute.rs#L722-L742
https://github.com/code-423n4/2024-10-coded-estate/blob/97efb35fd3734676f33598e6dff70119e41c7032/contracts/codedestate/src/execute.rs#L1280-L1300
In these functions, the rentals available time is specified by the property manager/owner and this is set into storage. But users can still make reservations for the property for times outside the rentals available period. This is because setreservationforshortterm() and setreservationforlongterm() do not check that the renting_period specified by a renting user is within the rental propertys available_period. As seen below in both functions, they only check that the renting_period is more than the rentals minimum stay duration, i.e., more than 1 day if minimum duration is 1 day. A real world scenario example of this bug is that a user can make still reservations for July 21-25th even though the property owner/manager has specified that the rentals available period is only June 21-25th.
https://github.com/code-423n4/2024-10-coded-estate/blob/97efb35fd3734676f33598e6dff70119e41c7032/contracts/codedestate/src/execute.rs#L795-L817
https://github.com/code-423n4/2024-10-coded-estate/blob/97efb35fd3734676f33598e6dff70119e41c7032/contracts/codedestate/src/execute.rs#L1353-L1374
Check that the renting_period specified by renting users is within the propertys available_period.
Context
blockchainstar12 (Coded Estate) acknowledged and commented:
adeolu (warden) commented:
