Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing events arithmetic in FjordPoints.sol

heim

Summary

The FjordPoints.setPointsPerEpoch(uint256) function in the FjordPoints contract lacks an event emission for changes to the pointsPerEpoch parameter. This omission makes it difficult to audit and track changes to this critical arithmetic parameter off-chain.

Vulnerability Details

Detecting changes to critical arithmetic parameters like pointsPerEpoch is essential for off-chain monitoring and auditing. Without emitting an event when pointsPerEpoch is updated, external systems cannot easily track these changes, potentially leading to discrepancies and a lack of transparency.

FjordPoints.setPointsPerEpoch(uint256) (src/FjordPoints.sol#191-197)

function setPointsPerEpoch(uint256 _points) external onlyOwner checkDistribution {
if (_points == 0) {
revert();
}
pointsPerEpoch = _points;
}

Impact

  • Severity: Low

  • Confidence: Medium

  • Limited Transparency: Off-chain systems may fail to detect updates to the pointsPerEpoch parameter.

  • Auditing Challenges: Difficulty in auditing changes to arithmetic parameters which might impact point distribution calculations.

  • Operational Risk: Increased risk that stakeholders are unaware of changes to important contract parameters, potentially causing discrepancies in expectations and actual point distribution.

Tools Used

  • Manual code review

Recommendations

Update the setPointsPerEpoch function to emit an event whenever pointsPerEpoch is modified. Example:

event PointsPerEpochUpdated(uint256 indexed previousPointsPerEpoch, uint256 indexed newPointsPerEpoch);
​
function setPointsPerEpoch(uint256 _points) external onlyOwner checkDistribution {
if (_points == 0) {
revert();
}
+ emit PointsPerEpochUpdated(pointsPerEpoch, _points);
pointsPerEpoch = _points;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.