Fjord Token Staking

Summary

The distributePoints function is designed to allocate points to stakeholders based on the elapsed time since the last distribution. A critical part of this function is the calculation of weeksPending, which determines how many epochs have passed. However, the function does not explicitly check if weeksPending is greater than zero, potentially leading to inefficiencies in the contract.

Vulnerability Details

The vulnerability lies in the fact that weeksPending can be 0, which means that no full epoch has passed since the last distribution. If weeksPending is zero, the function still updates the pointsPerToken, totalPoints, and lastDistribution storages, and emits a PointsDistributed event, even though no points are actually distributed. This can lead to unnecessary gas consumption and misleading logs.

• FjordPoints.sol#L241-L247

For example, if block.timestamp is slightly greater than lastDistribution, the calculated weeksPending may be 0. In this case, the function would proceed to update lastDistribution and emit an event without actually changing pointsPerToken or totalPoints.

Impact

• Gas inefficiency

• Misleading events

Tools Used

• Manual review

Recommendations

Implement a condition to ensure that weeksPending is greater than 0 before proceeding with state updates and event emissions. This prevents unnecessary operations when no full epoch has passed.