UserManager: totalStaked ≥ totalFrozen should be checked before and after totalFrozen is updated

Handle itsmeSTYJ Vulnerability details Impact The require statement in updateTotalFrozen and batchUpdateTotalFrozen to check that totalStaked ≥ totalFrozen should be done both before and after updateTotalFrozen is called to ensure that totalStake is still ≥ totalFrozen. This will serve as a sanit...

debtWriteOff updates totalFrozen immaturely, thereby losing staker rewards

Handle kenzo Vulnerability details debtWriteOff updates totalFrozen before withdrawing unionToken rewards. As the borrower is overdue, this means the staker calling debtWriteOff will lose his rewards if for example totalStaked == totalFrozen. Note: If the borrower would to first call...