Fjord Token Staking

Summary :

• Overall, the code base presents well documented functions and clear docstrings.However, The distributePoints function is documented as an admin-only function, but implemented as a public function in the code.https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordPoints.sol#L232

Vulnerability Details :

• The documentation states that the distributePoints function requires admin privileges to be called, suggesting restricted access. However, the actual implementation in the contract allows any user to call this function publicly.

Impact :

• Possible disruption of intended tokenomics if points are distributed more frequently than intended

Tools Used :

• Manual code review

Recommendations :

• Restrict access to the distributePoints function by marking it as onlyAdmin or another appropriate role modifier.

• Implement additional checks to ensure that the function is only called when necessary and under correct conditions.