qiibee - Staking

When transferring deflationary ERC20 tokens, the input amount may not equal the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens arrive in the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens causing the contract to lose 10 tokens in such a transaction. ```solidity=51 stakingToken.safeTransferFrom(beneficiary, address(this), amount); ``` - Transferring tokens by `amount`. ```solidity=55 userStake.amount += amount; ``` - The `amount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.

The contract serves as the underlying entity to interact with a third-party protocol The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=18 IERC20 public immutable stakingToken; ``` - The contract `Staking` interacts with third-party contract with `IERC20` interface via `stakingToken`.

Check-effect-interaction pattern violation occurs when a function makes an external call to another contract before resolving any effects. If an attacker can control the contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. In the `stake()` function, the state variables update and the event emission takes place after the call. \ In the `withdraw()` function the event is emitted after the external call.