Nodle

The emergencyWithdraw() function forcefully withdraws all tokens from the contract and sets totalStakedInPool = 0. Users attempting to claim rewards or unstake after emergencyWithdraw() will encounter issues since totalStakedInPool is already 0 and reverts the transaction. In addition, if owner adds the funds again, the value will remain 0, blocking the smart contract of future transactions.

The InsufficientRewardBalance check only verifies if there are enough tokens at the moment the function is called. It does not account for the possibility that other users might claim rewards or unstake concurrently, depleting the balance before transactions are processed.this can be replicated in this scenario:user1 and user2 put 10 tokens each one.Rewards are 20%, so each one will receive 12 tokens.Staking contract has 1 reward token. Pool now contains a total of 21 tokens.user1 claims and obtain 12 tokens. Pool now contains a total of 9 tokens.user2 claims or unstakes but their transaction gets reverted because there is not enough tokens in the smart contract.

The claim() and the unstake() functions take an index as input, but there's no check to ensure the index is within the bounds of the stakes[msg.sender] array before accessing the array.

The function unstake() allows users to desist from their stake, getting their funds back to their accounts. In technical terms, with this action, funds are never claimed but are instead unstaked. As such, the claimed variable of the user's stake should be left as false, to correctly show users of the platform of the action that was taken, e.g. when calling the function getStakeInfo() with the index of the specific stake.

The reward calculation suffers from potential precision loss due to integer division. Small stakes or low reward rates could result in users receiving less reward than expected.

The fundRewards() function is intended to be used only by REWARDS_MANAGER_ROLE but it is possible for any user to transfer NODL tokens to the contract and increase the rewards.

The getStakeInfo() function is declared as view, which means it should not modify the contract's state. Using a storage pointer would imply a potential modification of the state, which is not allowed in a view function. Storage variables also consume more gas.

Initializing variables to their default values spends gas unnecessarily.