Fjord Token Staking

Summary

The FjordAuction contract has a potential issue where precision loss during the calculation of claimable tokens can result in a small amount of tokens being permanently locked in the contract. This occurs due to integer division in the calculation of the multiplier and the subsequent calculation of claimable tokens.

Vulnerability Details

The FjordAuction contract allows users to bid using FjordPoints and claim auction tokens based on their bid proportion. The multiplier is calculated in the auctionEnd() function as follows:

In the claimTokens() function, the claimable tokens are calculated using this multiplier:

Due to integer division, the calculation of claimable tokens can lead to rounding errors. When these errors accumulate across all participants, some tokens may remain unclaimed in the contract. For example, if totalTokens is 1000 and totalBids is 3000, the multiplier would be calculated as (1000 * 1e18) / 3000 = 333333333333333333. If three participants each bid 1000 FjordPoints, each would get (1000 * 333333333333333333) / 1e18 = 333 tokens, resulting in a total of 999 tokens distributed and 1 token remaining locked in the contract.

Impact

A portion of the auction tokens may become permanently locked in the contract, leading to an uneven distribution of tokens among participants. This can result in participants receiving slightly fewer tokens than they should be entitled to, causing potential loss of value for the protocol and participants. The total number of tokens distributed does not match the totalTokens, leading to accounting discrepancies.

Proof of Concept

1. Deploy the FjordAuction contract with totalTokens set to 1000 and totalBids set to 3000.

2. Three participants each bid 1000 FjordPoints.

3. The multiplier is calculated as (1000 * 1e18) / 3000 = 333333333333333333.

4. Each participant claims their tokens:

   • Each gets (1000 * 333333333333333333) / 1e18 = 333 tokens.

   • Total distributed: 333 * 3 = 999 tokens.

   • 1 token remains locked in the contract.

Tools Used

Manual review

Recommendation

Implement a more precise token distribution mechanism and add a sweep function to handle any remaining tokens.