Fjord Token Staking

Summary

The FjordPoints contract has a precision loss issue in the updatePendingPoints modifier. Users with a stakedAmount less than PRECISION_18 (1e18) may not receive any points due to integer division truncation, leading to potential loss of rewards.

Vulnerability Details

In the FjordPoints contract, the updatePendingPoints modifier calculates the owed points using the formula:

This calculation involves dividing by PRECISION_18 (1e18), which can lead to precision loss. Solidity's integer division truncates towards zero, meaning any fractional points resulting from the division are discarded. If a user's stakedAmount is less than PRECISION_18, the result of this calculation can be zero, causing the user to miss out on their accumulated points.

Impact

Users with smaller staked amounts (less than PRECISION_18) may not receive any points for their staking activity. This results in an unfair distribution of rewards, as these users are effectively denied the points they have earned through staking.

Tools Used

Manual

Recommendations

To mitigate this issue, consider implementing a system to track fractional points. This could involve maintaining a separate variable to accumulate fractional points for each user, adding these to their pending points once they reach a whole point.