Fjord Token Staking

Summary

In the Fjord Staking System, rewards are added to the contract by the reward admin using the addReward() function. However, the new rewards are processed directly by checking the contract's token balance, which renders the reward admin role unnecessary.

Vulnerability Details

Reward admin is responsible for adding rewards using following addReward() function:

This function transfer the corresponding token to staking contract and then calls _checkEpochRollover() function in order to update the reward rate.

While reward rate update, new rewards is added from the token balance of staking contract. In conclusion, anyone can send Fjord token to staking contract in order to increase the reward rate

Impact

Low - Although this issue does not significantly impact the contract's functionality, it contradicts the documentation, which states that only the reward admin should be able to add rewards to the staking contract. The current implementation does not enforce this restriction.

Tools Used

Manual Review

Recommendations

Instead of calculating the reward amount based on the contract's token balance, the process should adhere to the addReward function for adding rewards to the previous epoch. This change would ensure that only the reward admin can add rewards, as intended.