Summary

Immutable addresses of WETH and Staking contract are not able to adjust to possible changes of addresses.

Vulnerability Details

Impact

There is a possibility that WETH changes the address of the contract in case of some vulnerability is found inside of the contract that will force them to redeploy it. In that situation they will need to migrate people to the new contract which is not an easy task but is doable and some protocols have done it. The same applies to the Staking contract.

Tools Used

Manual Analysis

Recommendations

Don't make addresses immutable and create a function with onlyOwner() modifier from Ownable.sol that changes addresses if needed.