QA Report

[code423n4]

Lines of code

https://github.com/code-423n4/2022-03-paladin/blob/main/contracts/HolyPaladinToken.sol#L729

Vulnerability details

Impact

If startDropPerSecond is initialized at less than endDropPerSecond the contract will be unusable. There will be an underflow in _updateDropPerSecond which will always revert. This function is called throughout the contract, in critical functions like lock and claim, if it were to always revert the contract would be broken and unusable.

Proof of Concept

If startDropPerSecond is initialized at less than endDropPerSecond in the constructor, the contract will be deployed without issue but will be broken.

Tools Used

Manual analysis

Recommended Mitigation Steps

Add a check in the constructor that ensures startDropPerSecond >= endDropPerSecond

[Kogaroshi]

PR with changes: PaladinFinance/Paladin-Tokenomics#8

[0xean]

Downgrading to QA based on the following as explained in #80

This is an exceedingly rare bug and unlikely to happen because

it is the admin that calls function setEndDropPerSecond.
it can only occur when block.timestamp == startDropTimestamp + dropDecreaseDuration. Reverts will not occur at any subsequent timestamp.

[JeeberC4]

Judge downgraded to QA, warden did not submit a QA Report, preserving original title: Potentially dead contract