API3 - audit

In the contract `StakeableVesting` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and modify critical configurations of the contract.  In the contract `StakeableVesting` the role `beneficiary` has authority over the functions shown in the diagram below. Any compromise to the `beneficiary` account may allow the hacker to take advantage of this authority and withdraw assets from the contract. 

The contract serves as the underlying entity to interact with one or more out-of-scope contracts. The scope of the audit treats out of scope contracts as black boxes, assumes their functional correctness, and the audited contracts interact with those contracts in a correct way. However, in the real world, those contracts might contain logic issues or security vulnerabilities, and this may lead to lost or stolen assets. ```solidity=29 address public immutable override api3Token; ``` - The contract `StakeableVesting` interacts with the out-of-scope contract with `IERC20` interface via `api3Token`. --- ```solidity=32 address public immutable api3Pool; ``` ```sol=243 staked = IApi3Pool(api3Pool).userStake(address(this)); ( unstaked, , , unstaking, unstakeScheduledFor, lastDelegationUpdateTimestamp, ) = IApi3Pool(api3Pool).getUser(address(this)); ``` ```sol=281 function poolBalance() private view returns (uint256) { uint256 staked = IApi3Pool(api3Pool).userStake(address(this)); (uint256 unstaked, , uint256 unstaking, , , , ) = IApi3Pool(api3Pool) .getUser(address(this)); return staked + unstaked + unstaking; } ``` - The contract `StakeableVesting` interacts with the out-of-scope contract with `IApi3Pool` interface via `api3Pool`. --- ```solidity=13 address public immutable override api3Token; ``` - The contract `StakeableVestingFactory` interacts with the out-of-scope contract with `IERC20` interface via `api3Token`.