Fjord Token Staking

Summary

Unfair reward distribution for new stakers.

Vulnerability Details

The current implementation of reward distribution allows new stakers to receive an unfair share of rewards accumulated before their stake. This occurs because the _checkEpochRollover() function distributes rewards based on the total staked amount at the time of distribution, without considering the duration of each stake.

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordStaking.sol#L691C3-L699C78

The issue stems from using a single point-in-time measurement (totalStaked at epoch end) to distribute rewards that have accumulated over the entire epoch. This approach fails to account for the dynamic nature of staking throughout the epoch.

For instance:

1. User A stakes 1000 tokens at the beginning of an epoch.

2. Near the end of the epoch, User B stakes 10000 tokens.

3. Epoch rollover occurs.

4. Rewards are distributed based on the total stake of 11000 tokens, with User B receiving a disproportionate share despite only staking for a short period.

Impact

Users who stake just before an epoch rollover can receive the same rewards per token as users who have been staking for the entire previous epoch. This creates an unfair advantage for new stakers and diminishes the rewards for long-term stakers.

Tools Used

Manual review

Recommendations

Implement a pro-rata reward distribution system that accounts for the duration of each stake within an epoch. This could involve tracking the stake start time for each user and calculating rewards based on the proportion of the epoch they were staked.