Fjord Token Staking

Summary

The method addReward() is used to add new rewards to the contract to calculate the updated rewardPerToken. But it can be frontrun with stake() with 1 wei of amount.

Vulnerability Details

If the reward distributor distribute the rewards but a user frontrun the transaction with stake() then the newly added rewards by the distributor will be considered in the next epoch.

https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordStaking.sol#L691-L724

Impact

As the epoch will be already updated, the newly added pool amount will be included in the next epoch.

Tools Used

VS Code

Recommendations

Consider including a flag to update the rewards of a particular epoch before user rewards are calculated.