Fjord Token Staking

Summary

A malicious user can abuse the epoch rollover window, between the rollover of the staking contract and the points contract, to "steal" the yield from the users that should rightfully earn the yield. This results also in loss of yield for the rightful users as well.

Vulnerability Details

In the attached test suite, the following scenario takes place. A malicious actor , let's call them Alice, can call the stake function so that funds are deposit in the staking contract. As a result, the onStaked hook will be invoked to the points contract. This actor has a time window to unstake the whole amount they staked, before their deposit gets locked at the epoch rollover. However, until then, if the epoch rolls over on the points contract, all the rightful users will lose yield, since the deposit of Alice dilutes their rewards. Simultaneously, Alice will get yield, which are points that on normal scenario belong to the rest of the stakers.

Add the following test to the stakeUnstake.t.sol file:

Running the above test prints the following:

(Making the above output "prettier" so that the finding is better understanded):
Rewards that Bob should rightfully take: 100000000000000000000

Rewards that Bob takes if Alice performs this attack: 990099009900990000

Percentage loss of yield of Bob: ( 100000000000000000000 - 990099009900990000 ) / 100000000000000000000 = 0.99 = 99%

The percentage loss of yield depends on rightful stakers deposits and the deposit of the malicious actor, however an specific scenarios, the loss of yield can be quite severe.

Impact

Loss of yield, so loss of rewards for rightful users.

Tools Used

Manual Review

Recommendations

The project should implement a function similar to common initialize function. Essentially, this function will be responsible for "syncing" the starting time of both contracts, so that there are no windows that malicious actors can use for their advantage, thereby disadvantaging all the other users as well.