Paladin - Warden Pledges contest - ctf_sec's results

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L636 https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L456 https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L488

Vulnerability details

Impact

Creator fund is stucked in the contract if the admin owner pause the contract and never unpause the contract.

In current implementation, the admin can pause the contract,

/**
 * @notice Pauses the contract
 */
function pause() external onlyOwner {
	_pause();
}

/**
 * @notice Unpauses the contract
 */
function unpause() external onlyOwner {
	_unpause();
}

after contract is paused, the user is not able to pledge and get reward.

 function pledge(uint256 pledgeId, uint256 amount, uint256 endTimestamp) external whenNotPaused

but the creator is not able to call

function closePledge(uint256 pledgeId, address receiver) external whenNotPaused nonReentrant

function retrievePledgeRewards(uint256 pledgeId, address receiver) external whenNotPaused nonReentrant 

then the creator fund that means to reward the pledged user is locked in the contract as long as the creator not unpause the contract.

Proof of Concept

Admin invokes the pause function

function pause() external onlyOwner

Creator cannot retrieve pledge reward or close pledge because these two function use the modifier whenNotPaused

Tools Used

Manual Review

Recommended Mitigation Steps

Usually in a reward distribution contract, the admin can pause the contract disable inbound action, but not blocking the outbound action.

For example,

in a staking contract, the user can stake token for reward, admin can pause the contract to not let user stake more token. but should not block user from withdraw their staked token when pausing the contract.

Same ideas applys here, we recommend the project remove WhenNotPaused in function below

function closePledge
function retrievePledgeRewards

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L265

Vulnerability details

Impact

the code below calculate the reward that user eligible to claim after user delegates the veToken voting power.

// Rewards are set in the Pledge as reward/veToken/sec
// To find the total amount of veToken delegated through the whole Boost duration
// based on the Boost bias & the Boost duration, to take in account that the delegated amount decreases
// each second of the Boost duration
uint256 totalDelegatedAmount = ((bias * boostDuration) + bias) / 2;
// Then we can calculate the total amount of rewards for this Boost
uint256 rewardAmount = (totalDelegatedAmount * pledgeParams.rewardPerVote) / UNIT;

if(rewardAmount > pledgeAvailableRewardAmounts[pledgeId]) revert Errors.RewardsBalanceTooLow();
pledgeAvailableRewardAmounts[pledgeId] -= rewardAmount;

// Send the rewards to the user
IERC20(pledgeParams.rewardToken).safeTransfer(user, rewardAmount);

note the logic

// each second of the Boost duration
uint256 totalDelegatedAmount = ((bias * boostDuration) + bias) / 2;
// Then we can calculate the total amount of rewards for this Boost
uint256 rewardAmount = (totalDelegatedAmount * pledgeParams.rewardPerVote) / UNIT;

if (totalDelegatedAmount * pledgeParams.rewardPerVote) / UNIT is 0, the user is not getting any reward.

Proof of Concept

given

uint256 rewardAmount = (totalDelegatedAmount * pledgeParams.rewardPerVote) / UNIT;

UNIT is hardcoded: 10 ** 18 if pledgeParams.rewardPerVote is a small number, such as 1 wei. and totalDelegatedAmount is for example, 100000000,

100000000 * 1 / UNIT is rounded to 0.

User delegates the vote power but does not get any reward.

Tools Used

Manual Review.

Recommended Mitigation Steps

Please add check to make sure that the user can get the reward after pledging.

uint256 rewardAmount = (totalDelegatedAmount * pledgeParams.rewardPerVote) / UNIT;
if(rewardAmount == 0) revert ZeroRewardAmount();