Phuture.Finance (Audit #2)

Function `withdrawAndSwap()` allows the caller to specify an external token-swap contract, to swap their share of staking token in this contract to reward token. On line 191, all staking token within this contract is temporarily approved to the target contract. Since the target contract can be arbitrarily set by the caller, it would be possible for an attacker to deploy a contract and use it as target contract to be called from `IndexBetting`. As a result, the approval statement on line 191 could give the attacker temporary access to all the staking token in this contract. ```solidity=191 STAKING_TOKEN.safeApprove(_swapTarget, type(uint256).max); _fillQuote(_swapTarget, _assetQuote); uint256 balanceOfIndexAfter = REWARD_TOKEN.balanceOf(address(this)); require(balanceOfIndexAfter - balanceOfIndexBefore >= _minBuyAmount, "IndexBetting: MIN"); uint256 assetBalanceAfter = STAKING_TOKEN.balanceOf(address(this)); require(assetBalanceBefore - assetBalanceAfter == assets, "IndexBetting: MAX"); STAKING_TOKEN.safeApprove(_swapTarget, 0); ```

Function `startBettingChallenge()` allows the contract owner to set the betting start time and end time. It can be called multiple times by the owner to make updates, as long as `PDIRewardRate` is not set yet. This makes it possible to "restart" the betting before it ends, and end the betting early.

There should always be events emitted in the sensitive functions that are controlled by centralization roles. Contract `IndexBetting`: - `startBettingChallenge()`

Functions `withdraw()`, `withdrawAndMint()` and `withdrawAndSwap()` handles staking token withdrawal and transfers reward token to holders, after betting ends. The reward rate is 5% for victory and 2% for defeat. Function `withdraw()` calculates reward only with defeat rate, and the other two functions covers the case of victory. However, all the three functions could be called in either betting results. In the case of victory, a user could call `withdraw()` and miss the reward. In case of defeat, the other two functions could be called to calculate the reward with victory rate, as long as the external call is successful.