Opulous (Staking Pools) Addendum

The smart contract is missing some significant checks on transactions.

`stake:amount` is stored in the local mapping with `stake:slot` to be the key, and it is read and copied to the slot 2 of the scratchspace each time when the subroutine `set_stake_props` is triggered. For the other three fields in the mapping, `slot:time`, `slot:lockup` and `slot:apy`, they are not likely to reach the max value if the inputs are valid. The opcode `extract_uint64` will throw an error and revert the transaction if the number to be casted is greater than the max value of `uint64`.

According to the [Opulous staking pool - Two Tokens Documentation](https://docs.google.com/presentation/d/10wPB30GeKNVZpofiLm_3iHmNNkwJq7o9mInTk56sjbo/edit#slide=id.g13845b68ce3_0_6), whitelist tokens will be used in the pool to control user access, and users who have a balance of the token will be able to stake in the pool. Our current understanding is that if the target ASA is owned by an admin address, then the admin can determine the initial set of addresses by transferring the target ASA to them. For example, let's say each address receives 10 tokenAlpha from the admin. Then the addresses with tokenAlpha can transfer their tokenAlpha balance to more addresses. Then all these addresses with tokenAlpha balance have permission to stake to the pool. We would like to confirm if the above-described behavior is intended and allowed. At meanwhile, it seems the `add_whitelist` branch can be renamed to `set_whitelist`, since it does not check if the `whitelist_token_id` is empty before `app_global_put`. We would like to confirm the intention of this branch as well.