Paladin - Warden Pledges contest - ktg's results

Lines of code

https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L256-L265

Vulnerability details

Impact

User who pledge can loose their boost and receive no reward without any warning, reducing user experience

Proof of Concept

The current reward amount received by user when calling pledge function is calculated as follow:

uint256 slope = amount / boostDuration;
uint256 bias = slope * boostDuration;

uint256 totalDelegatedAmount = ((bias * boostDuration) + bias) / 2;

uint256 rewardAmount = (totalDelegatedAmount * pledgeParams.rewardPerVote) / UNIT;

First of all, uint256 slope = amount / boostDuration, since this is integer division, if amount < boostDuration, then slope = 0 and rewardAmount = 0.

If slope !=0, rewardAmount can still =0 if totalDelegatedAmount * pledgeParams.rewardPerVote) < UNIT.

After these steps, the function does not check if rewardAmount > 0 and go ahead with the transfer:

if(rewardAmount > pledgeAvailableRewardAmounts[pledgeId]) revert Errors.RewardsBalanceTooLow();
        pledgeAvailableRewardAmounts[pledgeId] -= rewardAmount;

        // Send the rewards to the user
        IERC20(pledgeParams.rewardToken).safeTransfer(user, rewardAmount);

Since many ERC20 tokens will not revert with transfer amount = 0, the user will lose boost balance and receive back 0 reward amount without any proper warning because the boost amount is already transferred at this step https://github.com/code-423n4/2022-10-paladin/blob/main/contracts/WardenPledge.sol#L248-L253.

Tools Used

Manual review.

Recommended Mitigation Steps

I recommend checking if rewardAmount =0 and revert with an explanation like The pledge amount is too small.