Fjord Token Staking

Vulnerability Details

FjordStaking.sol - In the current implementation, the epoch is tracked using the variable currentEpoch

This approach does not guarantee that the user will stake for the full 7 days for each epoch.

PoC

1. The protocol is deployed and legitimate users begin staking immediately.

2. Attacker waits for the time before epoch finishes (say on the 7th day)

3. On the beginning of 8th day the currentEpoch is now 2

4. The protocol regards that both the legitimate users and attacker have staked for an entire epoch which is FALSE.

5. Both the legitimate users and attacker claim their rewards.
   Note: In the current implementation the ud.unclaimedRewards is not updated correctly thus claiming will revert with NothingToClaim() This is another separate finding.

Impact

• Unfairness to early stakers.

• Unfair advantage to stakers who monitor the currentEpoch. to stake and claim reward after short time.

Tools Used

Manual review

Recommendations

Consider also tracking the time that user stakes so that the time spent staking is proportional to the rewards.