Paladin - Warden Pledges contest - corerouter's results

A governance lending protocol transforming users voting power into a new money lego.

General Information

Platform: Code4rena

Start Date: 27/10/2022

Pot Size: $33,500 USDC

Total HM: 8

Participants: 96

Period: 3 days

Judge: kirk-baird

Total Solo HM: 1

Id: 176

League: ETH

Paladin

Findings Distribution

Researcher Performance

Rank: 69/96

Findings: 1

Award: $19.64

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L469

Vulnerability details

Impact

In line 468 of WardenPledge.sol, the Pledge is set as closed if it is not closed which has same effect with closePledge() function. However, the ClosePledge() event is not emitted in this case while ClosePledge() event is emitted in closePledge() function.

Proof of Concept

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L469

Tools Used

Change the related codes from:

if(!pledgeParams.closed) pledgeParams.closed = true;

to:

if(!pledgeParams.closed) { pledgeParams.closed = true; emit ClosePledge(pledgeId); }

#0 - trust1995

2022-10-30T21:53:45Z

Don't believe a missing event qualifies for medium severity. It is a valuable QA suggestion.

#1 - Kogaroshi

2022-10-30T23:45:14Z

Duplicate of #111

#2 - kirk-baird

2022-11-11T21:45:47Z

This is amount a missing event rather than incorrect documentation (as in #111) so I'm going to consider this QA.

#3 - c4-judge

2022-11-11T21:45:58Z

kirk-baird changed the severity to QA (Quality Assurance)

#4 - c4-judge

2022-11-12T00:20:54Z

kirk-baird marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter