Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Distribution of points is susceptible to precision loss due to division before multiplication

Ward

Summary

Users may experience continuous small losses due to division before multiplication precision loss in distributePoints.

Vulnerability Details

The FjordPoints.distributePoints function calculates the points for a staker by first multiplying pointsPerEpoch by PRECISION_18, then dividing by totalStaked, and then multiplying by weeksPending. If pointsPerEpoch is small enough and totalStaked is large enough, the division may result in losses in points distribution.

function distributePoints() public {
if (block.timestamp < lastDistribution + EPOCH_DURATION) {
return;
}
​
if (totalStaked == 0) {
return;
}
​
uint256 weeksPending = (block.timestamp - lastDistribution) / EPOCH_DURATION;
pointsPerToken =
pointsPerToken.add(weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked))); // @audit precision loss
// pointsPerToken += weeksPending * (pointsPerEpoch * PRECISION_18 / totalStaked)
totalPoints = totalPoints.add(pointsPerEpoch * weeksPending);
lastDistribution = lastDistribution + (weeksPending * 1 weeks);
​
emit PointsDistributed(pointsPerEpoch, pointsPerToken);
}

Impact

Stakers may not receive expected points due to precision loss.

Tools Used

Foundry

Recommendations

Update the calculation so that multiplications are done first and divisions last;

pointsPerToken =
- pointsPerToken.add(weeksPending * (pointsPerEpoch.mul(PRECISION_18).div(totalStaked))); // @audit precision loss
+ pointsPerToken.add((weeksPending * (pointsPerEpoch.mul(PRECISION_18))).div(totalStaked));
Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Division before multiplication

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.