# Reward can be over- or undercounted in extendPledge and increasePledgeRewardPerVote

Paladin WardenPledge reuses stale votesDifference when extending or boosting a pledge, so reward totals are miscomputed, over- or underpaying creators.

- Payout: Audit contest
- Severity: medium
- Program: Paladin
- Found by: Jeiwan
- Disclosed: 2023-01-06
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-paladin#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-paladin%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** WardenPledge.sol pledge reward accounting (extendPledge, increasePledgeRewardPerVote)
**Root cause:** votesDifference is cached at createPledge time and never recomputed in extendPledge/increasePledgeRewardPerVote, even though the receiver's votingEscrow.balanceOf may have changed.
**Steps:**
1. Create a pledge with targetVotes and rewardPerVote; votesDifference = targetVotes - votingEscrow.balanceOf(receiver) is cached.
2. Receiver's veToken balance changes (more locked or expired).
3. Call `extendPledge(pledgeId, newEndTimestamp, maxTotalRewardAmount, maxFeeAmount)` or `increasePledgeRewardPerVote(pledgeId, newRewardPerVote, maxTotalRewardAmount, maxFeeAmount)`.
4. Observe totalRewardAmount computed with stale `pledgeParams.votesDifference`, not the current balance.
**How found:** Code reading of createPledge vs extendPledge/increasePledgeRewardPerVote, noticing votesDifference is stored once and reused without recalculation against current votingEscrow.balanceOf.
**Exploitation:** If receiver balance rose, creator overpays; excess reward is unclaimable because _pledge reverts with TargetVotesOverflow past targetVotes. If balance fell, reward is underpaid and the target cannot be reached.
**Insight:** When a contract caches a derived value (votesDifference) at creation, check every later mutation path that reuses it against live external state like balanceOf; stale caches silently skew accounting.