Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Rewards can be added without update epoch being triggered

pontifex

Summary

The Reward Admin can not be sure that rewards are being added in the particular epoch since the addReward function does check if the epoch was updated.

Vulnerability Details

Due to the codebase comments it is expected that the addReward invoke must update epoch and be the last action of the epoch:

/// @notice addReward should be called by master chef
>> /// must be only call if it's can trigger update next epoch so the total staked won't increase anymore
>> /// must be the action to trigger update epoch and the last action of the epoch
/// @param _amount The amount of tokens to be added as rewards.
function addReward(uint256 _amount) external onlyRewardAdmin {
//CHECK
if (_amount == 0) revert InvalidAmount();
​
//EFFECT
uint16 previousEpoch = currentEpoch;
​
//INTERACT
fjordToken.safeTransferFrom(msg.sender, address(this), _amount);
​
_checkEpochRollover();
​
emit RewardAdded(previousEpoch, msg.sender, _amount);
}

In fact the addReward invoke can be frontrun maliciously or accidentally and the action will become the first action of the next epoch.
This can cause unexpected/unfair rewards distribution for previous epochs.

Impact

Unexpected behavior, unfair reward distribution

Tools used

Manual Review

Recommendations

Consider checking if update epoch was triggered:

function addReward(uint256 _amount) external onlyRewardAdmin {
//CHECK
if (_amount == 0) revert InvalidAmount();
​
//EFFECT
uint16 previousEpoch = currentEpoch;
​
//INTERACT
fjordToken.safeTransferFrom(msg.sender, address(this), _amount);
​
_checkEpochRollover();
+
+ if (previousEpoch == currentEpoch) revert CustomError();
+
emit RewardAdded(previousEpoch, msg.sender, _amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.