Fjord Token Staking

Summary

The lastDistribution variable in the FjordPoints contract is initialized to the contract deployment time. This can lead to inaccurate point distribution calculations if there is a significant delay between the contract deployment and the first token stake.

Vulnerability Details

The lastDistribution variable is set to block.timestamp at the time of contract deployment:

When the distributePoints() function is called, it calculates the number of weeks pending since the last distribution:

If the first token stake occurs long after the contract deployment (e.g., 1 month later), the weeksPending calculation would return a value greater than 1. This would cause the pointsPerToken to accumulate points for multiple weeks, even though no tokens were staked during that time.

Impact

This issue leads to an unintended accumulation of points.

For example:

1. The FjordPoints contract is deployed on 2024/09/01

2. The first token stakes happens one month later

3. The weeksPending is 4

4. The pointsPerToken accumulates points of 4 weeks for the first token stake.

Tools Used

vscode

Recommendations

Initiate the lastDistribution in the distributePoints() function instead of the constructor, set the lastDistribution to block.timestamp if it is zero.