Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The epoch updates of the `FjordStaking` and `FjordPoints` contracts are not synchronized, resulting in users being able to obtain Points at almost no cost.

zraxx

Summary

The epoch updates of the FjordStaking and FjordPoints contracts are not synchronized, resulting in users being able to obtain Points at almost no cost.

Vulnerability Details

The epoch update method of the FjordStaking contract is using function getEpoch.

function getEpoch(uint256 _timestamp) public view returns (uint16) {
if (_timestamp < startTime) return 0;
return uint16((_timestamp - startTime) / epochDuration) + 1;
}
​

The epoch update of the contract FjordPoints is in the function distributePoints.

function distributePoints() public {
if (block.timestamp < lastDistribution + EPOCH_DURATION) {
return;
}
​
if (totalStaked == 0) {
return;
}
​
uint256 weeksPending = (block.timestamp - lastDistribution) / EPOCH_DURATION;
pointsPerToken =
pointsPerToken.add(weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked)));
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
lastDistribution = lastDistribution + (weeksPending * 1 weeks);
​
emit PointsDistributed(pointsPerEpoch, pointsPerToken);
}
​

Although their cycles are both one week, the different starting times result in different update times. Therefore, an attacker can stake when the epoch of the contract FjordPoints is about to be updated, but the epoch of the contract FjordStaking will not be updated, and then unstake after the epoch of the contract FjordPoints is updated, thereby obtaining Points in a short time.

Impact

Attackers can obtain Points at almost no cost.

Tools Used

Vscode

Recommendations

The startTime of FjordStaking should be added with padding to synchronize with the contract FjordPoints.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

If epoch end times of FjordStaking and FjordPoints are desynchronized, users will be able to exploit the desynchronization to stake>claim>unstake instantly, getting points they shouldn't

Impact: High - Users are getting an unreasonable amount of points through exploiting a vulnerability Likelihood: Low - Most of the times, when using the script, all deployment tx will get processed in the same block. But, there is a small chance for them to be processed in different blocks.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.