Open code423n4 opened 1 year ago
The issue is acknowledge, and we do calculate fee on the basis of all rewards, and not only the one that are gonna be used to reward users. The fee ratio is gonna be of 1% to start with (might change before deploy based on market estimations), and the Core team will be able to change the ratio quickly to adapt it to market and Pledge creators needs (with also considering the Paladin DAO revenues). The Paladin team will also considers Pledge creators that are in specific cases and overpay fees (because they already have delegated boost that will last through the whole Pledge and more), and will be able to refund a part of those fees to the creator if the DAO agrees And if this system does not fit in the current market, and is a blocker to potential Pledge creators, we will be able to modify the way fees are handled, and deploy a new iteration of Pledge pretty fast to answer the issue.
kirk-baird marked the issue as satisfactory
kirk-baird marked the issue as selected for report
kirk-baird marked the issue as primary issue
Lines of code
https://github.com/code-423n4/2022-10-paladin/blob/d6d0c0e57ad80f15e9691086c9c7270d4ccfe0e6/contracts/WardenPledge.sol#L328
Vulnerability details
Description
Paladin receives a 5% cut from Boost purchases, as documented on the website
"Warden takes a 5% fee on Boost purchases, and 5% on Quest incentives. However, there are various pricing tiers for Quest creators. Contact the Paladin team for more info."
Here's how fee calculation looks at
createPledge
function:The issue is that the fee is taken up front, assuming
totalRewardAmount
will actually be rewarded by the pledge. In practice, the rewards actually utilized can be anywhere from zero tototalRewardAmount
. Indeed, reward will only betotalRewardAmount
if, in the entire period from pledge creation to pledge expiry, the desired targetVotes will be fulfilled, which is extremly unlikely.As a result, if pledge expires with no pledgers, protocol will still take 5%. This behavior is both unfair and against the docs, as it's not "Paladin receives a 5% cut from Boost purchases".
Impact
Paladin fee collection assumes pledges will be matched immediately and fully, which is not realistic. Therefore far too much fees are collected at user's expense.
Proof of Concept
Tools Used
Manual audit
Recommended Mitigation Steps
Fee collection should be done after the pledge completes, in one of the close functions or in a newly created pull function for owner to collect fees. Otherwise, it is a completely unfair system.