Fjord Token Staking

Summary

The natspec of UnstakeAll function mentions that it allows the user to unstake from all epochs at once. However, it doesn't unstake for the current epoch. As a result, a user might expect that all the stakes they have done have been successfully unstaked and if the epoch rollovers, the funds of the user are locked, until the lock period passes.

Vulnerability Details

unstakeAll does not unstake the current's epoch deposit of the user. Users can unstake immediately through the unstake function for the current epoch. However, the same logic is not present in the unstakeAll function that only checks for the deposits that have been made in epochs and the lock time period has elapsed.

Add the following code in the stakeUnstake.t.sol file:

The output of the test is the following:

Impact

Not expected functionality and lock of user funds for the lock period if epoch rollovers.

Tools Used

Manual Review

Recommendations

Consider adding a similar check to the unstakeAll function like the check for the current epoch like unstake function, so that unstakeAll also unstakes immediately the deposit of users for the same epoch.