Paladin - Warden Pledges contest - RaoulSchaffranek's results

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L475 https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L508 https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L271

Vulnerability details

Impact

Some features won't work with fee-on-transfer tokens. In particular, the following functions will revert because the transfers will exceed the actual balance of the protocol: retrievePledgeRewards, closePledge. Moreover, the rewards issued by pledge function will be less than expected because the receiver pays the token fees. In other cases, the pledge function may revert because the protocol's balance is too low.

The issue is classified as high risk because pledgers can lose tokens. Moreover, some features can become unavailable.

Recovering

It is possible to recover from the DoS state by donating reward tokens to the WardenPledge system. Notice that the receivers of transfers initiated by the protocol still pay the token transfers.

Proof of Concept

https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L475 https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L508 https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L271

Tools Used

• Let pledgers specify a minimum reward amount. Compute the difference between the balance before and after the rewards were transferred to the pledger. If the difference is less than is desired minimal amount, revert.
• Modify the internal accounting logic for reward tokens to account for received tokens.