It should not submit a project with no total budget. Requires at least one task with cost > 0

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-rigor/blob/main/contracts/Community.sol#L206-L282

Vulnerability details

Impact

When publishing a project, there is still possibility the project doesn't have any task or 0 budget.

Proof of Concept

According to contest guideline, there is an information says

"Note that you cannot submit a project with no total budget. Therefore it requires at least one task with a budget > 0."

Meanwhile, on publishProject() in Community.sol, there is no check of this condition.

Recommended Mitigation Steps

Add a new require which will check if the first task (which is at index 1), its cost is > 0.

  // Local instance of variables. For saving gas.
  IProject _projectInstance = IProject(_project);
  ...

  // Revert if project doesn't have one task with budget > 0
  require(_projectInstance.tasks[1].cost > 0, "First task > 0");

[parv3213]

The docs here were deprecated. A project doesn't have to have any task published in a community.

[jack-the-pug]

This is a valid Medium based on the docs (even though it's deprecated now)