Fjord Token Staking

Vulnerability Details:

In the auctionEnd() function, the calculation of the multiplier value may result in significant precision loss if totalTokens is much smaller than totalBids.

Impact:

This precision loss could lead to incorrect token distribution calculations, potentially resulting in users receiving fewer tokens than they should, or in extreme cases, no tokens at all.

Proof of Concept:

Link to code

If totalTokens is 1 and totalBids is 1,000,000, the result of this calculation would be 0, leading to no tokens being distributed.

Tools Used: Manual review

Recommendations

• Reorder the operations to perform multiplication last:

• Consider using a higher precision factor if dealing with very small token amounts.

• Implement a minimum multiplier value to ensure some token distribution occurs.

• Lack of Minimum Bid Amount