Fjord Token Staking

Description:
The contract includes several critical functions (e.g., setOwner, setRewardAdmin, addAuthorizedSablierSender, removeAuthorizedSablierSender) that are protected only by the onlyOwner modifier. While this provides a basic level of protection, there is no additional mechanism, such as a time lock or multi-signature requirement, to prevent accidental or malicious use.

Location:

src/FjordStaking.sol

• setOwner function (Line 347)

• setRewardAdmin function (Line 352)

• addAuthorizedSablierSender function (Line 357)

• removeAuthorizedSablierSender function (Line 361)

Issue:
If the owner's private key is compromised or if the owner accidentally configures the contract incorrectly, it could lead to significant issues, such as the inability to distribute rewards correctly or unauthorized addresses gaining privileges.

Impact:

• Compromise of the owner's account or incorrect configuration of critical settings could severely disrupt the operation of the staking contract, affecting all users.

Tools used: Manual Review.

Recommendations:
Implement additional safeguards for these critical functions, such as a time lock, multi-signature requirement, or a two-step process for executing these functions.

Potential changes:

• Introduce a time lock or multi-signature requirement for critical functions.

Changes needed for which line of code:

• Implementing a Time Lock-

  (Example)