Fjord Token Staking

Summary

The _checkEpochRollover function updates the rewardPerToken for each epoch by adding pendingRewardsPerToken to the reward per token value of the previous epoch. However, this approach results in the same rewardPerToken value being assigned to all the epochs in the range from lastEpochRewarded + 1 to currentEpoch. This could lead to inaccuracies in reward distribution, as the pendingRewardsPerToken should reflect changes in rewards per token specific to each epoch.

Vulnerability Details

In the current implementation, the rewardPerToken for each epoch is calculated as:

This calculation uses a constant pendingRewardsPerToken for each epoch, which means every epoch in the range from lastEpochRewarded + 1 to currentEpoch will have the same reward per token value. This is incorrect because the pendingRewardsPerToken should be updated based on the actual rewards distributed during each epoch. Instead of accumulating rewards correctly per epoch, this implementation uses a flat value that might not accurately represent the distribution of rewards over time.

Impact

This issue will result in inaccurate reward calculations for epochs where the rewards should vary. As a result, users may receive either too little or too much reward, depending on the actual distribution of rewards during each epoch. This could lead to discrepancies in the reward distribution, potentially causing disputes among users and undermining the integrity of the reward system.

Tools Used

Manual Code Review

Recommendations

To address this issue, calculate rewardsPerToken separately for each epoch based on the rewards distributed during that specific epoch.