Change function visibility from public to internal or private
Summary
The update() and updateFor() functions in Staking.sol contract are public and can be called from anyone
Vulnerability Details
In the current implementation, anyone can call update and updateFor function which will lead to recalculating the index and shares if there are changes in the data. But it's not required because all of the other functions (ex: deposit, withdraw, claim) call updateFor(msg.sender) on execution.
Impact
No significant impact, anyone can call them and recalculate the index before it's needed from one of the other functions which use index for calculations.
Tools Used
Manual
Recommendations
Make the functions internal or private, because they are called for every contract operation (ex: deposit, withdraw, claim).
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.