The totalStaked
value should accurately reflect the total amount of tokens deposited into strategies. Any discrepancy between totalStaked
and the actual deposited amount can lead to incorrect state variable.
when calling deposit
function, the _account
balance would be sent to StakingPool
contract and it would be deposited into strategy using _depositLiquidity
. But the _depositLiquidity
does not account the _amount
instead it use token.balanceOf(address(this))
to deposited into strategy.
Users and stakeholders may receive inaccurate information about the staked amounts, leading to a lack of trust.
manual review
Consider to add amount deposited when calling _depositLiquidity
.
Consider to add a function to handle idle/rogue token inside the StakingPool
so it can be deposited into strategy.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.