Fjord Token Staking

Summary

the _unstakeVested function does not correctly handle scenarios where a portion of the tokens has already been withdrawn from a vested stream before the stream is canceled. This could lead to incorrect unstaking amounts, resulting in inconsistencies in the contract's state and potential errors in reward calculations.

Vulnerability Details

The _unstakeVested function is responsible for managing the unstaking of vested tokens when a Sablier stream is canceled. The function currently assumes that the full vested amount is available for unstaking, without accounting for any partial withdrawals that may have occurred before the stream was canceled.

the function directly reduces the vestedStaked amount by the provided amount without checking whether some of the vested tokens have already been withdrawn. This lead to overestimating the available balance and attempting to unstake more tokens than are actually present.

Impact

1: The user's balance and the contract's state will be incorrectly updated, leading to discrepancies between the actual and recorded amounts.

Tools Used

Manaul review

Recommendations

1: Before unstaking, the function should check the current balance of the stream, considering any prior withdrawals.

2: The function should adjust the unstaking amount based on the actual remaining balance, ensuring that only the tokens still in the stream are unstaked.

3: Implement a full check of the stream’s current state, including any modifications, before proceeding with the unstake.