Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Add validation when set pointsPerEpoch in FjordPoints contract.

bytesflow007

Summary

Validate _points value to ensure stakers can get rewards when the owner calls setPointsPerEpoch.

Vulnerability Details

1) Calculating the added new pointsPerToken for the past epochs(one epoch or many epochs) in FjordPoints contract, the formula involved weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked). Normally, the pointsPerEpoch.mul(PRECISION_18)is so much greater than totalStakedwhen pointsPerEpoch= 100 ether.

function distributePoints() public {
​
// ignore code
uint256 weeksPending = (block.timestamp - lastDistribution) / EPOCH_DURATION;
pointsPerToken =
pointsPerToken.add(weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked)));
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
lastDistribution = lastDistribution + (weeksPending * 1 weeks);
​
emit PointsDistributed(pointsPerEpoch, pointsPerToken);
}
​

2) However, any positive number can be set when calling setPointsPerEpoch, such as make points = 1000; when the total stake is less than 1000*1e18, the newly added pointsPerToken will be equal to zero.

3) Normally, the input points will be at least greater than one ether when the owner calls this function. It's better to make the points bigger than one value to avoid unnecessary ignorance.

function setPointsPerEpoch(uint256 _points) external onlyOwner checkDistribution {
// no check
if (_points == 0) {
revert();
}
​
pointsPerEpoch = _points;
}

Impact

Stakers can't get expected rewards when the owner inputs the little points comparing the user's total staked.

Tools Used

Manual

Recommendations

Add _points validation to guarantee that the user can get rewards.

// FjordPoints contract
function setPointsPerEpoch(
uint256 _points
) external onlyOwner checkDistribution {
//if (_points == 0) {
// revert();
//}
// make sure below vaule greater than zero
if(_points.mul(PRECISION_18).div(totalStaked)==0){
revert();
}
​
pointsPerEpoch = _points;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.