Summary

The FjordPoints.setStakingContract() function should be called only once. If the staking address in the FjordPoints contract is ever changed, it will disrupt accounting and cause a denial-of-service (DoS) for the FjordStaking contract's unstaking functions.

Vulnerability Details

The interaction between the FjordPoints and FjordStaking contracts suggests that the staking address should remain immutable. Any change to this address will break the unstaking functionality in the FjordStaking contract, potentially leading to user funds being permanently locked.

Impact

Users will be unable to withdraw their funds.

Tools Used

Manual review.

Recommendations

Ensure the FjordPoints.setStakingContract() function can only be initialized once. Implement a check that reverts the transaction if the staking address is already set to a non-zero value.