Paladin - Warden Pledges contest - adriro's results

A governance lending protocol transforming users voting power into a new money lego.

General Information

Platform: Code4rena

Start Date: 27/10/2022

Pot Size: $33,500 USDC

Total HM: 8

Participants: 96

Period: 3 days

Judge: kirk-baird

Total Solo HM: 1

Id: 176

League: ETH

Paladin

Findings Distribution

Researcher Performance

Rank: 47/96

Findings: 2

Award: $31.16

QA:
grade-b
Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Define WEEK constant using native units

The WEEK constant can be defined by using 7 days.

Validate chestAddress in constructor

Validate chestAddress != address(0) during contract initialization.

Validate minTargetVotes in constructor

Validate that minTargetVotes > 0 in the contract's constructor to match the semantics in the associated updateMinTargetVotes setter.

Consider adding a "paginated" version of getAllPledges

The pledges array will eventually grow in size as the contract is used and will keep all historic pledges. Consider adding a paginated (offset + length) version of this accessor.

Validate endTimestamp in the _pledge function

Validate that the endTimestamp parameter is not in the past. This isn't a big issue since uint256 boostDuration = endTimestamp - block.timestamp; will underflow and revert, but consider adding a validation and returning a proper error.

#0 - c4-judge

2022-11-12T01:07:37Z

kirk-baird marked the issue as grade-b

Unchecked math in _pledge function

The update in line 268 can be done using unchecked math since rewardAmount <= pledgeAvailableRewardAmounts[pledgeId] due to the check in line 267.

Unneeded storage read in createPledge function

In line 340 there's an unnecessary read from storage since pledgeAvailableRewardAmounts[vars.newPledgeID] should be 0 since we are creating a new pledge with a new unused id. Consider changing this line to be a simple assignment:

pledgeAvailableRewardAmounts[vars.newPledgeID] = vars.totalRewardAmount;

pledgeParams.endTimestamp is read twice in extendPledge and increasePledgeRewardPerVote

This storage variable is readed twice in lines 380 and 382 in the extendPledge function and similarly in lines 426 and 430 in the increasePledgeRewardPerVote function. Consider storing the first read from storage locally to prevent a re-read.

pledgeParams.rewardToken is read twice in extendPledge and increasePledgeRewardPerVote

This storage variable is readed twice in lines 394 and 396 in the extendPledge function and similarly in lines 438 and 440 in the increasePledgeRewardPerVote function. Consider storing the first read from storage locally to prevent a re-read.

#0 - c4-judge

2022-11-12T01:07:52Z

kirk-baird marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter