instantUnstake function can be frontrunned with fee increase

Lines of code Vulnerability details Impact instantUnstake allows user to unstake their stakingToken for a fee paid to the liquidity providers. This fee could be changed up to 100% any moment by admin. Malicious admin could frontrun users instantUnstake transaction and set fee to any value using...

The timestamp of the specified duration is reset after the position is added via stake().

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. I noticed that the stake amount change in stake is +=, which means that the project itself defaults to adding positions at the same duration, but the timestamp of the duration is overwritten by =...

cooldown is set to 0 when the user sends all tokens to himself.

Lines of code Vulnerability details Impact In the beforeTokenTransfer function, cooldowns will be set to 0 when the user transfers all tokens to himself. Consider the following scenario Day 0: The user stakes 100 tokens and calls the cooldown function Day 10: the user wanted to unstake the tokens...

permitAndMulticall() May Be Used to Steal Funds Or as a Denial Of Service if _from Is Not The Message Sender

Lines of code Vulnerability details Impact When the from address is not the msg.sender multiCall will be made on behalf of the msg.sender. As a result each of the functions called by multiCall will be made on behalf of msg.sender and not from. If functions such as transfer or unstake are called...

unstake should update exchange rates first

Handle cmichel Vulnerability details The unstake function does not immediately update the exchange rates. It first computes the validatorSharesRemove = tokensToSharesamount, v.exchangeRate with the old exchange rate. Only afterwards, it updates the exchange rates if the validator is not disabled:...