Paladin - Warden Pledges contest - Nyx's results

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L653

Vulnerability details

Impact

recoverERC20() allows the retrieval of all ERC20 tokens from contract whereas the comment indicates it is only meant to retrieve those tokens that have been sent by mistake. Allowing to retrieve all tokens also enables the retrieval of legitimate ones. It could be seen as allowing a rug pull by project and should be avoided.

Proof of Concept

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L653

Tools Used

VSCode

Recommended Mitigation Steps

Prevent the retrieval of legitimate tokens.