Submission Details
Severity:
The staking contract address is not set in the FjordPoints::constructor function
Vulnerability Details
The staking contract address is not set in the FjordPoints::constructor function:
/* FjordPoints::constructor function */
constructor() ERC20("BjordBoint", "BJB") {
owner = msg.sender;
lastDistribution = block.timestamp;
pointsPerEpoch = 100 ether;
}
Impact
The FjordStaking contract cannot call the FjordPoints::onStaked and FjordPoints::onUnstaked functions. As a result, the contract owner needs to call the FjordPoints::setStakingContract function to set the staking contract address.
Recommendations
Update the FjordPoints::constructor function:
/* FjordPoints::constructor function */
- constructor() ERC20("BjordBoint", "BJB") {
+ constructor(address _staking) ERC20("BjordBoint", "BJB") {
owner = msg.sender;
lastDistribution = block.timestamp;
pointsPerEpoch = 100 ether;
+ staking = _staking;
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230
USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.