Platform: Code4rena
Start Date: 27/10/2022
Pot Size: $33,500 USDC
Total HM: 8
Participants: 96
Period: 3 days
Judge: kirk-baird
Total Solo HM: 1
Id: 176
League: ETH
Rank: 67/96
Findings: 1
Award: $19.64
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: robee
Also found by: 0x007, 0x1f8b, 0x52, 0xDjango, 0xNazgul, 0xSmartContract, 8olidity, Awesome, B2, Bnke0x0, Chom, Diana, Dravee, JTJabba, Jeiwan, Josiah, Lambda, Mathieu, Picodes, RaoulSchaffranek, RaymondFam, RedOneN, ReyAdmirado, Rolezn, Ruhum, Sm4rty, Tricko, Trust, Waze, __141345__, a12jmx, adriro, ajtra, brgltd, c3phas, carlitox477, cccz, ch0bu, chaduke, chrisdior4, corerouter, cryptonue, csanuragjain, ctf_sec, cylzxje, delfin454000, dic0de, djxploit, horsefacts, imare, jayphbee, jwood, ktg, ladboy233, leosathya, lukris02, minhtrng, neko_nyaa, oyc_109, pashov, peritoflores, rbserver, rvierdiiev, shark, tnevler, yixxas
19.6449 USDC - $19.64
A few improvements can be made to enhance the readability and trustworthiness of the contract.
pledges[i].AvailableRewardAmount
pledges[i].pledgeOwner
both functions, retrievePledgeRewards() and closePledge() have similar functionality: close the Pledge and retrieve all remaining reward ammount. Suggestion: delete one of them or refactor so that they both call another common internal function
https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L599 The transfer of ChestAddress needs to be done in two steps to avoid input error: 1) submit a new pending chest; 2) the new pending chest accept the proposal and accept it become the new chest address.
In the function removeRewardToken(), one needs to consider if there are some pledges that use this token as the reward token and if yes, then might need to wait for these pledges to close before removing the token from the contract.
Consider to call RecoverERC20() inside RemoveRewardToken() so that ERC20 will always be recovered while it is being removed.
The full impact of function updateRewardToken() has not been fully implemented or documented: does the new minRewardPerSecond change existing pledges? If not, then it should be documented.
Consider define a CreatorOnly modifier for those pledge functions that can be called only by the creator.
#0 - c4-judge
2022-11-11T23:45:08Z
kirk-baird marked the issue as grade-b