Paladin - Warden Pledges contest - chaduke's results

A governance lending protocol transforming users voting power into a new money lego.

General Information

Platform: Code4rena

Start Date: 27/10/2022

Pot Size: $33,500 USDC

Total HM: 8

Participants: 96

Period: 3 days

Judge: kirk-baird

Total Solo HM: 1

Id: 176

League: ETH

Paladin

Findings Distribution

Researcher Performance

Rank: 67/96

Findings: 1

Award: $19.64

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

A few improvements can be made to enhance the readability and trustworthiness of the contract.

  1. pledgeAvailableRewardAmounts, can be defined in the Pledge struct, in this way, no separate mapping is necessary and it is easy to look up for the AvailableRewardAmount for each Pledge and the data structure is more organized. The ith pledge's AvaiablerRewardAmount is:
pledges[i].AvailableRewardAmount
  1. pledgeOwner can be defined in the Pledge struct, in this way, no mapping is needed and and it is easy to look up for the owner for each Pledge and the data structure is more organized. The ith pledge's owner is:
pledges[i].pledgeOwner
  1. both functions, retrievePledgeRewards() and closePledge() have similar functionality: close the Pledge and retrieve all remaining reward ammount. Suggestion: delete one of them or refactor so that they both call another common internal function

  2. https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L599 The transfer of ChestAddress needs to be done in two steps to avoid input error: 1) submit a new pending chest; 2) the new pending chest accept the proposal and accept it become the new chest address.

  3. In the function removeRewardToken(), one needs to consider if there are some pledges that use this token as the reward token and if yes, then might need to wait for these pledges to close before removing the token from the contract.

  4. Consider to call RecoverERC20() inside RemoveRewardToken() so that ERC20 will always be recovered while it is being removed.

  5. The full impact of function updateRewardToken() has not been fully implemented or documented: does the new minRewardPerSecond change existing pledges? If not, then it should be documented.

  6. Consider define a CreatorOnly modifier for those pledge functions that can be called only by the creator.

#0 - c4-judge

2022-11-11T23:45:08Z

kirk-baird marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter