Paladin - Warden Pledges contest - KingNFT's results

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L325

Vulnerability details

Impact

The reward token reserved in pledge is not enough, funds will be used up before the targetVotes is reached.

Proof of Concept

The 'totalRewardAmount ' is calculated based on current votingEscrow token balanceOf receiver.

function createPledge(
    // ...
) external whenNotPaused nonReentrant returns(uint256){
    // ...
    vars.votesDifference = targetVotes - votingEscrow.balanceOf(receiver);

    vars.totalRewardAmount = (rewardPerVote * vars.votesDifference * vars.duration) / UNIT;
    // ...
}

But votingEscrow balance would decrease over time, which makes the actual votesDifference increase during pledge

@external
@view
def balanceOf(addr: address, _t: uint256 = block.timestamp) -> uint256:
    _epoch: uint256 = self.user_point_epoch[addr]
    if _epoch == 0:
        return 0
    else:
        last_point: Point = self.user_point_history[addr][_epoch]
        last_point.bias -= last_point.slope * convert(_t - last_point.ts, int128)
        if last_point.bias < 0:
            last_point.bias = 0
        return convert(last_point.bias, uint256)

reference from https://etherscan.io/address/0x5f3b5DfEb7B28CDbD7FAba78963EE202a494e2A2#code

This makes reserved fund is not enough to reach target votes

Tools Used

VS Code

Recommended Mitigation Steps

Use endTimestamp to calculate votingEscrow token balance

function createPledge(
    // ...
) external whenNotPaused nonReentrant returns(uint256){
    // ...
    vars.votesDifference = targetVotes - votingEscrow.balanceOf(receiver, endTimestamp);
    // ...
}