Paladin - Warden Pledges contest - 8olidity's results

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L653

Vulnerability details

Impact

If the user has no intention to send 100 tokens that charge fees to the contract, at this time the administrator wants to take these tokens out, but the tokens will charge 10% commission, but because the code is written to send the full balance, then the contract does not have enough tokens to pay fees, resulting in the administrator can never take out

Proof of Concept

    function recoverERC20(address token) external onlyOwner returns(bool) {
        if(minAmountRewardToken[token] != 0) revert Errors.CannotRecoverToken();

        uint256 amount = IERC20(token).balanceOf(address(this));
        if(amount == 0) revert Errors.NullValue();
        IERC20(token).safeTransfer(owner(), amount);

        return true;
    }

Tools Used

vscode

Recommended Mitigation Steps

Example Add a token whitelist