Fjord Token Staking

Summary

front-running attacks in its onStaked and onUnstaked functions. Both functions use the checkDistribution modifier, which calls distributePoints(). The distributePoints() function is called before updating the user's stake.

• Point distribution depends on the current totalStaked amount.

• Transactions are visible in the mempool before they are processed

Vulnerability Details.

Alice submits a transaction to stake a large amount of tokens.

• Bob, a malicious actor, sees Alice's pending transaction in the mempool.

• Bob quickly submits his own staking transaction with a higher gas price.

• Bob's transaction gets processed first, increasing the totalStaked amount.

• distributePoints() is called, calculating pointsPerToken based on the new totalStaked amount.

• Alice's transaction is processed, but she receives fewer points per token than she would have if her transaction was processed first.

Impact

• Users could receive more points than they should when unstaking.

• This creates an unfair advantage for users who can monitor the mempool and quickly submit transactions.

• Users could receive fewer points than expected when staking.

Tools Used

Manual Review

Recommendations

Process stakes/unstakes in batches at fixed intervals.OR use commit-reveal scheme