Fjord Token Staking

Summary

The FjordStaking::onStreamCanceled function in the contract contains a ternary conditional statement that determines the amount variable. However, due to the nature of the contract's logic, this conditional check results in dead code, as senderAmount will always be less than nftData.amount. This results in the amount being always equal to senderAmount, making the ternary condition redundant.

Vulnerability Details

In the FjordStaking::stakeVested function, the _amount is calculated as follows:

Given the following example(As stream is not yet cancelled):

1. depositedAmount = 100

2. withdrawnAmount = 10

3. refundedAmount = 0

The calculated _amount is:

So if now consider stream is cancelled sender(Sender of stream) would receive:

Note: senderAmount is calculated in sablier contract SablierV2LockupLinear::_cancel function.

Here to senderAmount be greater than staked amount through stream streamed amount should be less than 10 which is not possible as we are considering withdrawn amount as 10. So in function FjordStaking::onStreamCanceled FjordStaking::_amount would never be assigned to nftData.amount.

When a stream is canceled, the senderAmount should be less than or equal to the _amount to ensure the refund does not exceed the staked amount. In this scenario, the senderAmount will always be less than the _amount if:

senderAmount < _amount
Since streamedAmount is less than withdrawnAmount, and refundedAmount is zero, the amount variable in onStreamCanceled will always be equal to senderAmount. This makes the ternary condition redundant, as uint256(senderAmount) will always be less than or equal to nftData.amount.

Impact

The redundant ternary conditional check introduces unnecessary complexity into the contract and results in unwanted code execution. While this does not pose a direct security risk, it affects gas efficiency and code maintainability.

Tools Used

Manual

Recommendations