Flokifi Staking

In the contract `FlokiRewardToken` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and mint arbitrary amounts of tokens. 

The function `stake()` does not check the `_minimumStakeTimestamp` not greater than the `endsAt`. Then there will be a period after `endsAt` with no rewards. However, when the user unstakes before `_minimumStakeTimestamp` the user will pay a penalty fee.

When the user calls the extendStake function, the duration will be changed, which means the duration multiplier should be changed as well. However, there is no update of unstakeTimestamp in this function.

The function pauseStaking incorrectly change the state of `isPaused`.

In the constructor of the PenaltyFee contract, the `penaltyBasis` will be set by the parameter and it can be close to the MULTIPLIER_BASIS. Hence the `penaltyFee` can be bigger than the stake amount which is unreasonable.

In the function `extendRewardsDuration()`, the extended duration will be added to the old duration, the endsAt will be delayed for the extended duration as well. So this function needs to be called immediately after the old duration is over.

In the functions `getUserRewards()` and `rewardPerToken()`, the calculation uses the decimal to avoid the divide truncation issue. However, the base digit of the multiplication is missing in the calculation.

When the function `setStakingDuration` is called, no previous reward tokens are left since the previous duration is over. However, there is no new reward tokens transferred in the contract. The similar issue is existing in the function `extendRewardsDuration`.

In the function `lastTimeRewardApplicableForUser`, the code logic will check whether the `block.timestamp` is greater than the unstakeTimestamp[_user]. If yes, it will directly return the unstakeTimestamp[_user]. If not, it means `block.timestamp` is not greater than the unstakeTimestamp[_user]. Since the _unstakeTimestamp must be not greater than endsAt which is restricted when staking, so the `block.timestamp` must be smaller than endsAt. ```solidity function lastTimeRewardApplicableForUser(address _user) public view returns (uint256) { if (block.timestamp > unstakeTimestamp[_user]) { return unstakeTimestamp[_user]; } return block.timestamp < endsAt ? block.timestamp : endsAt; } ```

The contract is serving as the underlying entity to interact with third-party `stakingToken`. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. ```solidity=127 stakingToken.safeTransferFrom(msg.sender, address(this), _amount); ```