Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Use of Multiple ERC20 contract names may lead to unexpected behavior and security risks

bladesec

Summary

The codebase employs two distinct implementations of ERC20, leading to inconsistencies and exposing potential future risks.

Vulnerability Details

Following ERC20 contracts are used in FjordPoints and FjordStaking:

  • ERC20 (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol)

  • ERC20 (lib/solmate/src/tokens/ERC20.sol)

// SPDX-License-Identifier: AGPL-3.0-only
pragma solidity =0.8.21;
​
> import { ERC20 } from "lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol";
import { ERC20Burnable } from
"lib/openzeppelin-contracts/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import { SafeMath } from "lib/openzeppelin-contracts/contracts/utils/math/SafeMath.sol";
import { IFjordPoints } from "./interfaces/IFjordPoints.sol";
/**
* @title FjordPoints
* @dev ERC20 token to represent points distributed based on locked tokens in Staking contract.
*/
​
contract FjordPoints is ERC20, ERC20Burnable, IFjordPoints {
using SafeMath for uint256;
...
// SPDX-License-Identifier: AGPL-3.0-only
pragma solidity =0.8.21;
​
> import { ERC20 } from "solmate/tokens/ERC20.sol";
import { SafeTransferLib } from "solmate/utils/SafeTransferLib.sol";
import "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
import { ISablierV2Lockup } from "lib/v2-core/src/interfaces/ISablierV2LockupLinear.sol";
import { ISablierV2LockupRecipient } from
"lib/v2-core/src/interfaces/hooks/ISablierV2LockupRecipient.sol";
import { IFjordPoints } from "./interfaces/IFjordPoints.sol";
​
...
​
contract FjordStaking is ISablierV2LockupRecipient {
...

Impact

While not posing an immediate threat according to the code implemented at the time of this audit, the issue could lead to future problems.

Tools Used

Manual Review

Recommendations

Select a single ERC20 implementation and apply it consistently across your project. Remove the unused ERC20 import and update all references to align with the chosen implementation.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.