WeMix - Liquid Staking audit

In the function `deposit()`, the user deposits `WEMIX` into the contract, then the contract deposits them into the Staking address and mints share `stWEMIX` token to the user. But when the user calls the function `withdraw()`, the function burns the share `stWEMIX` token of the user and withdraws `WEMIX` token from the Staking address to the contract. No action was taken to transfer the `WEMIX` token to the user. So the user can not get the `WEMIX`. ```solidity=254 function _withdraw(uint256 amount_) internal returns (uint256 wemixAmount_) { address msgSender = _msgSender(); require(amount_ != 0, "StWEMIX::_withdraw:CANNOT_WITHDRAW"); require( amount_ <= balanceOf(msgSender), "StWEMIX::_withdraw:NOT_ENOUGH_BALANCE" ); // burn uint256 _fee = getSharesByPooledWEMIXWithFee(fee()); // in stWEMIX wemixAmount_ = getPooledWEMIXBySharesWithFee(amount_); _burn(msgSender, amount_); // unstaking staking.withdraw(pid, wemixAmount_, payable(address(this)), false); // compound _compound(); emit Withdrew(msgSender, wemixAmount_); // fee _mint(treasury, _fee); } ```

The function `feeUpdate()` does not limit the percentage of fees applied. The fee of phase two rates could therefore be 100%. If the `feePhaseTwo` is set to `10000`, the reward will be 0 and all fees will be sent to the treasury address.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=52 treasury = treasury_; ``` - `treasury_` is not zero-checked before being used.

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.