Submission Details
Severity:
[L-1] Wrong points value for PointsDistributed event in distributePoints function
Vulnerability Details
The distributePoints() function calculates the correct amount of variables for points distribution and emits the PointsDistributed event. According to the documentation, the first argument of the event should be 'the total number of points distributed.' There is a storage variable that holds this number.
FjordPoints::distributePoints()
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
However, instead of totalPoints, pointsPerEpoch is used as the points parameter.
FjordPoints::distributePoints()
emit PointsDistributed(pointsPerEpoch, pointsPerToken);
Impact
Frontend or other off-chain services may display incorrect values, potentially misleading users.
Tools Used
Manual
Recommendations
Use totalPoints instead of pointsPerEpoch.
contract FjordPoints is ERC20, ERC20Burnable, IFjordPoints {
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
lastDistribution = lastDistribution + (weeksPending * 1 weeks);
- emit PointsDistributed(pointsPerEpoch, pointsPerToken);
+ emit PointsDistributed(totalPoints, pointsPerToken);
}
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
distributePoints calls `emit PointsDistributed` with pointsPerEpoch, instead of totalPoints
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230 USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.