Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`newStake` amount is recorded in `stakeVested` leading to incorrect calculation of rewards for user who staked his vested FJO tokens

befree3x

newStake amount is recorded in stakeVested leading to incorrect calculation of rewards for user who staked his vested FJO tokens

Vulnerability Details

The function FjordStaking::stake records each newStake amount during an epoch.

​
function stake(uint256 _amount) external checkEpochRollover redeemPendingRewards {
...
newStaked += _amount;
...
​

On the other hand, the function FjordStaking::stakeVested records the staked vFJO token in the FjordStaking contract during an epoch via the variable newVestedStaked. However, as depicted below, it also increases the value of newStake, which is not fit for its purpose.

​
newStaked += _amount; // @audit-issue why newStaked is increased here?
newVestedStaked += _amount;
​

Although in _unstakeVested, the value of newStake has been adjusted alongside with newVestedStaked, it can create confusion. In addition, in the function _checkEpochRollover as described below, the pendingRewards is calculated with consideration of newStaked. If a user who has staked massively his vested FJO, he can get a disadvantage on the pending reward as the value of the variable pendingRewards will be reduced due to the accounting of new staked vFJO inside newStaked.

function _checkEpochRollover() internal {
....
// no distribute the rewards to the users coming in the current epoch
>> uint256 pendingRewards = (currentBalance + totalVestedStaked + newVestedStaked)
- totalStaked - newStaked - totalRewards;
uint256 pendingRewardsPerToken = (pendingRewards * PRECISION_18) / totalStaked;
totalRewards += pendingRewards;
...
​

Impact

A user who stakes his vested FJO can have his reward wrongly calculated, hence, losing his legitimate points.

Tools Used

Manual review.

Recommendations

newStake should only account for the new staked FJO tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.