Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

An attacker can increase his claiming points during the last period before the claimPoints call

Dowsers

Summary

The claiming points amounts is related to the duration and the last total staked amount, if an user increase the totalStaked during the last epoch, this value of totalStaked will be considered for all the periods of staking. An attacker could stake a large amount during the last epoch to get a maximum of points.

Vulnerability Details

We made two tests.

In the first test, the user alice stake 0.0001 ether for 5 weeks then 2 ether for 2 weeks, alice claim points and obtains 799999999999999999998 points.

In the second test, the user alice stake 2 ether for 2 weeks than 0.0001 ether for 5 weeks, alice claim points and obtains 799999999999999999998 points.

This situation is unfair because the ponderated staking amount by time is not the same.

function test\_POC3() public {
​
​
uint256 balancePointsAliceBefore = POINTS.balanceOf(alice);
vm.warp(vm.getBlockTimestamp() + POINTS.EPOCH_DURATION());
POINTS.distributePoints();
​
​
vm.prank(alice);
fjordStaking.stake(0.0001 ether);
​
skip(5 weeks);
vm.prank(alice);
fjordStaking.stake(2 ether);
skip(2 weeks);
vm.prank(alice);
POINTS.claimPoints();
​
uint256 balancePointsAliceAfter = POINTS.balanceOf(alice);
assert(balancePointsAliceAfter > 0);
}
​
function test_POC4() public {
uint256 balancePointsAliceBefore = POINTS.balanceOf(alice);
vm.warp(vm.getBlockTimestamp() + POINTS.EPOCH_DURATION());
POINTS.distributePoints();
​
​
vm.prank(alice);
fjordStaking.stake(2 ether);
​
skip(5 weeks);
vm.prank(alice);
fjordStaking.stake(0.0001 ether);
skip(2 weeks);
vm.prank(alice);
POINTS.claimPoints();
uint256 balancePointsAliceAfter = POINTS.balanceOf(alice);
assert(balancePointsAliceAfter > 0);
}

Impact

Loss of funds for some users.

Tools Used

Foundry

Recommendations

Modify the modifier updatePendingPoints(address user) to include the history of staking for each period.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic

Appeal created

0xpinto Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
0xpinto Submitter
about 1 year ago
0xpinto Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.