Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`FjordPoints::staking` is not initialized in the `constructor`

tnevler

Summary

FjordPoints::staking variable is not initialized in the constructor.

Vulnerability Details

FjordPoints::staking variable is not initialized in the constructor as it said in NatSpec.

Code Snippet

/**
@> * @dev Sets the staking contract address and initializes the ERC20 token.
*/
constructor() ERC20("BjordBoint", "BJB") {
owner = msg.sender;
lastDistribution = block.timestamp;
pointsPerEpoch = 100 ether;
}
/**
* @dev Modifier to check if the caller is the staking contract.
*/
modifier onlyStaking() {
if (msg.sender != staking) {
revert NotAuthorized();
}
_;
}
function onStaked(address user, uint256 amount)
external
@> onlyStaking
checkDistribution
updatePendingPoints(user)
{
UserInfo storage userInfo = users[user];
userInfo.stakedAmount = userInfo.stakedAmount.add(amount);
totalStaked = totalStaked.add(amount);
emit Staked(user, amount);
}
/**
* @notice Records the amount of tokens unstaked by a user.
* @param user The address of the user unstaking tokens.
* @param amount The amount of tokens being unstaked.
*/
function onUnstaked(address user, uint256 amount)
external
@> onlyStaking
checkDistribution
updatePendingPoints(user)
{
UserInfo storage userInfo = users[user];
if (amount > userInfo.stakedAmount) {
revert UnstakingAmountExceedsStakedAmount();
}
userInfo.stakedAmount = userInfo.stakedAmount.sub(amount);
totalStaked = totalStaked.sub(amount);
emit Unstaked(user, amount);
}

Impact

Without initializing the FjordPoints::staking variable in the constructor, FjordPoints::onStaked and FjordPoints::onUnstaked functions can't be called because of FjordPoints::onlyStaking modifier until the owner sets it in the FjordPoints::setStakingContract function.

Tools Used

Manual review.

Recommendations

Set FjordPoints::staking in the constructorimmediately:

/**
* @dev Sets the staking contract address and initializes the ERC20 token.
*/
- constructor() ERC20("BjordBoint", "BJB") {
+ constructor(adress _staking) ERC20("BjordBoint", "BJB") {
+ if (_staking == address(0)) {
+ revert InvalidAddress();
+ }
+ staking = _staking;
owner = msg.sender;
lastDistribution = block.timestamp;
pointsPerEpoch = 100 ether;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.