StRSR.cancelUnstake doesn't call _payoutRewards before minting new shares

Lines of code Vulnerability details Impact StRSR.cancelUnstake doesn't call payoutRewards before minting new shares. As result this rewards will be distributed for new staker as well. Proof of Concept If user wants to cancel his withdraw, then he can call StRSR.cancelUnstake and mint new shares...

attacker can make stakeRate to be 1 in the StRSR contract and users depositing tokens can lose funds because of the big rounding error

Lines of code Vulnerability details Impact code calculates amount of stake token and rsr token based on stakeRate and if stakeRate was near 1e18 then division error is small but attacker can cause stakeRate to be 1 and that can cause users to loss up to 1e18 token during stake and unstake. Proof ...

Function stake() and unstake() doesn't have correct rounding, they both round up when calculating caller funds and stakers lose funds slowly and contract rewards acting users

Lines of code Vulnerability details Impact Functions stake and unstake in StRSR contract is used for depositing RSR tokens and withdrawing them. but calculations in those functions is always rewarding caller as it rounds up when calculating caller amount. This can give attacker opportunity to sta...