Fjord Token Staking

Summary

The penalty tokens are subtracted from the totalRewards but are not added back to the reward pool or made withdrawable by the contract admin. As a result, these penalty tokens become inaccessible.

Vulnerability Details

When a user claims rewards and incurs a penalty, the penalty amount is subtracted from the totalRewards. This subtraction prevents the penalty tokens from being accounted for in the available reward pool for the next epoch:

Additionally, the contract lacks a function to withdraw these locked penalty tokens, meaning they cannot be recovered.

Impact

The penalty tokens are locked.

Tools Used

vscode

Recommendations

Not subtract the penaltyAmount from totalRewards, so that the penaltyAmount tokens could be distributed in the next epoch.