Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Users can instantly accrue `Fjord Points` on staking

greed

Summary

FjordPoints are accrued when users stake their Fjord tokens in FjordStaking.

Every EPOCH_DURATION (1 week) after the last distribution occurred, the pointsPerToken is calculated in distributePoints(). This value represents the number of points owed to users depending on the Fjord tokens they staked.

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordPoints.sol#L242-L243

function distributePoints() public {
if (block.timestamp < lastDistribution + EPOCH_DURATION) {
return;
}
​
if (totalStaked == 0) {
return;
}
​
uint256 weeksPending = (block.timestamp - lastDistribution) / EPOCH_DURATION;
@ pointsPerToken =
@ pointsPerToken.add(weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked)));
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
lastDistribution = lastDistribution + (weeksPending * 1 weeks);
​
emit PointsDistributed(pointsPerEpoch, pointsPerToken);
}

Vulnerability Details

In order to claim their points almost instantly, without having to wait for the 1 week period, users are able to stake their tokens right before the period is reached.

Here is a PoC that demonstrates how a user would achieve it:

function testStepwiseJump() public {
// setup
address attacker = makeAddr("attacker");
uint256 tokenAmount = 1000e18;
​
deal(address(token), attacker, tokenAmount);
​
vm.prank(attacker);
token.approve(address(fjordStaking), type(uint256).max);
​
// attacker stakes right before he can claim points
skip(1 weeks - 1);
vm.startPrank(attacker);
fjordStaking.stake(tokenAmount);
​
// attacker claims points next block
skip(1);
POINTS.claimPoints();
assertEq(
POINTS.balanceOf(attacker),
100e18
);
}

Impact

Users can claim their points earned instantly.

Users are incentivized to stake their tokens at a strategic time in order to fully benefit from the points.

Tools Used

Manual review

Recommendations

Implement a mecanism responsible for enforcing users to wait for at least 1 week after they staked their tokens before being able to claim their points.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.