Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

FjodPoints::distributePoints() should update lastDistribution when totalStaked = 0

elser17

Summary

FjodPoints::distributePoints() should update lastDistribution when totalStaked = 0.

Vulnerability Details

distributePoints() function is called via checkDistribution modifier whenever a user stakes, unstakes or claims rewards. What this function does is update pointsPerToken and totalPoints state variables if a new epoch has started since last update and there are tokens staked. However, in case there were no token staked it will not update lastDistribution, allowing for the function being called again and having these variables artificially updated.

Impact

A user could make pointsPerToken increase a lot by staking tokens when totalStaked = 0 and making another operation that calls distributePoints() again, then other users could benefit from this and get more rewards than they should due to this artificial increasement.

Tools Used

Manual revision

Recommendations

If totalStaked = 0, update lastDistribution timestamp so that rewardsPerToken cannot be updated again until next epoch.

function distributePoints() public {
if (block.timestamp < lastDistribution + EPOCH_DURATION) {
return;
}
​
if (totalStaked == 0) {
+ uint256 weeksPending = (block.timestamp - lastDistribution) / EPOCH_DURATION;
+ lastDistribution = lastDistribution + (weeksPending * 1 weeks);
return;
}
​
uint256 weeksPending = (block.timestamp - lastDistribution) / EPOCH_DURATION;
pointsPerToken =
pointsPerToken.add(weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked)));
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
lastDistribution = lastDistribution + (weeksPending * 1 weeks);
​
emit PointsDistributed(pointsPerEpoch, pointsPerToken);
}
```
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.