Summary

The pending rewards amount is calculated incorrectly.

Vulnerability Details

The pending rewards amount is calculated using the following formula:

uint256 pendingRewards = (currentBalance + totalVestedStaked + newVestedStaked) - totalStaked - newStaked - totalRewards;

The variable newStaked holds the amount of staked FJORD tokens, including the vested FJORD tokens. When a user calls stakeVested to stake their NFT from Sablier, both the newStaked and newVestedStaked variables are incremented by the _amount.

This leads to the vested tokens being added twice, which are not removed when calculating the pending rewards.

Impact

Wrongly calculation of pending reward.

Tools Used

Manual

Recommendations

Remove the vested FJORD tokens one more time from the formula used for calculating pending rewards.