Summary

Users can't stake and withdraw because of the use of "_msgSender()".

Vulnerability Details

Below, both internal functions - _stake and _withdraw - uses _msgSender() to represent the caller.

stake(msgSender(), poolId, amount, getCurrentPoolRate(poolId));
withdraw(msgSender(), poolId, amount, getCurrentPoolRate(poolId));

The contract calls " __Ownable_init()" in the Distribution_init function. This means _msgSender() reprsents the contract's owner.

See Openzeppelin's OwnableUpgradeable contract (https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/releases/tag/v4.9.2). Going by the package.json file of this contract, the contract uses v4.9.2.

As it is, only the owner of the contract can call stake and withdraw functions.

Impact

stake and withdraw functions would revert when called by users

Tools Used

Manual review

Recommendations

msg.sender should be used instead of _msgSender()