Illuvium (Part 4 - Staking V2)

The function `_swapETHForILV(...)` swaps ETH for ILV tokens. However, the function does not validate the Oracle’s output. What if the price returned is zero? What if it is absurdly large? Moreover, SushiSwap works as an AMM (Automated Market Maker), which can be manipulated by big investors.

The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries.

Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. For example, if a `for` loop requires too much gas to exit, then it may prevent the contract from functioning correctly entirely. It is best to break such loops into individual functions as possible. Any user can make an arbitrary number of stakes. However, this can lead for very large arrays of stakes, and such arrays need to be traversed, such as in function `CorePool.BalanceOf(...)`and `CorePool.getV1StakePosition(...)`(and other functions of the same file). The size of the pools must also be considered, since some functions have to loop over the pools, such as in function `ILVPool.claimYieldRewardsMultiple(...)`.

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. In this project, only the owner can set pools, convert ETH to ILP in `Vault.sol` and only the owner can perform upgrades in `PoolFactory.sol`.