Fjord Token Staking

Summary

FjordPoints.distributePoints() function doesn't distribute points for the period of totalStaked == 0 but the undistributed amount of points will be distributed after totalStaked becomes larger than zero.

Vulnerability Details

The relevant code of FjordPoints.distributePoints()is following.

As shown above, the function returns in L237 when totalStaked == 0 but doesn't update lastDistribution.
Therefore, after totalStaked becomes larger than zero, the undistributed amount of points will be distributed.

Scenario 1:

1. Assume that pointsPerEpoch = 1000.

2. At first week, totalStaked == 0, so no points are distributed at all.

3. At second week, totalStaked becomes 100 > 0. Then 2 * 1000 = 2000 points are distributed to the stakers at second week.

On the other hand, the above vulnerability causes newly set pointsPerEpoch is applied to the period before it set.

Scenario 2:

1. Assume that pointsPerEpoch = 1000.

2. At first week, totalStaked == 0, so no points are distributed at all.

3. At first week, admin changes pointsPerEpoch to be 2000. Since totalStaked == 0, lastDistribution is not updated.

4. At second week, totalStaked becomes 100 > 0. Then 2 * 2000 = 4000 points instead of 1000 + 2000 = 3000 points are distributed to the stakers.

Code Snippet:

• FjordPoints.distributePoints()

Impact

Undistributed amount of points when totalStaked == 0 will be distributed after totalStaked becomes larger than zero.
Newly set pointsPerEpoch is applied to the period before it set.

Tools Used

Manual Review

Recommendations

Modify FjordPoints.distributePoints() function as follows.