Fjord Token Staking

Summary

The FjordStaking contract exhibits a design flaw in its reward distribution mechanism. Users who stake tokens near the end of an epoch receive an equal share of rewards as those who staked at the beginning, despite having their tokens locked for a significantly shorter duration. This creates an imbalance in the reward system and potentially encourages timing-based strategies that may be perceived as unfair.

Vulnerability Details

New stakes are recorded separately from the total staked amount. The total staked amount is only updated during epoch transitions. Reward calculation uses the total staked amount, excluding new stakes. Example scenario:

• Epoch duration: 7 days

• Alice stakes 1000 tokens on day 1

• Bob stakes 1000 tokens on day 6

• At the end of the epoch, Alice and Bob receive the same reward, despite Alice's tokens being staked for 6 days longer

Impact

• Reward Disparity by users staking for shorter periods within an epoch receive disproportionately high rewards relative to their staking duration

• Strategic Timing by knowledgeable users may time their stakes to maximize rewards while minimizing lock-up periods

Tools Used

• Manual Review

Recommendations

Introduce a Gradual Reward Accrual System