Beedle - Oracle free perpetual lending

Summary

Staking rewards can be diluted by people who transfer staking tokens to the staking contract by any means other than by calling the deposit function.

Vulnerability Details

Staking rewards can be diluted by people who transfer staking tokens to the staking contract by any means other than by calling the deposit function. e.g by calling the token.transfer(address(staking), amount) while never being able to claim rewards hence diluting the reward pool permanently.

Impact

Reward pool is diluted permanently

Tools Used

My hunger for reward maximisation

Recommendations

Add a new global storage variable (e.g uint public tknBalance) and update it whenever the deposit and withdraw functions are called. Then use it here (https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Staking.sol#L62) for calculations