Submission Details
Severity:
FjordPoints contract doesn't set the staking contract address in the constructor
Summary
FjordPoints contract doesn't set the staking contract address in the constructor.
Vulnerability Details
In FjordPoints constructor should set the staking address as if not set it will be 0 address and all onlyStaking functions will revert. The staking address can be set by an admin but from comment it is expected to be already set and it can cause confusion and invalid transactions.
constructor() ERC20("BjordBoint", "BJB") {
owner = msg.sender;
lastDistribution = block.timestamp;
pointsPerEpoch = 100 ether;
}
Impact
Not setting the staking contract will make all onlyStaking functions revert.
Tools Used
Manual Review
Recommendations
Set the staking address in the constructor.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230 USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.