stake.link

Summary

The _transfer function is responsible for transferring the ownership of a lock from one address to another. It is a critical part of the ERC721 token standard implementation, which this contract adheres to. However, there is a missing check to ensure that the _from address is not the same as the _to address. Transferring a lock where the _from and _to addresses are the same can lead to unintended consequences like the double changing of state variables.

Since the _updateRewards function logic depends on the rewards pool, this could create an exploit depending on the implementation of the rewards pool.

By adding this check, we can ensure that locks are not transferred to the same address that already owns them, thus mitigating the described vulnerability.

Recommendations

Add a check to the _transfer function to ensure that _from != _to.