Fjord Token Staking

Summary

Users can stake closer to the weekend to earn more points and rewards.

Vulnerability Details

When a user stakes, the contract will call the function checkDistribution to update pointsPerToken, but the update cycle is one week. Therefore, when staking is done near the weekend, pointsPerToken will not be updated. This allows users to earn points in a shorter time.

For example, a attacker could stake a few minutes before the end of the weekend and unstake it after the lock period. That is to say, users can get 7 weeks of points by staking for about 6 weeks.

The same issue occurs in the contract FjordStaking.sol.

Impact

User can earn more points and and rewards.

Tools Used

Vscode

Recommendations

pointsPerToken and `rewardPerToken` should be updated every time a stake is made or unstake is made.