UserManager: totalStaked ≥ totalFrozen should be checked before and after totalFrozen is updated

Handle itsmeSTYJ Vulnerability details Impact The require statement in updateTotalFrozen and batchUpdateTotalFrozen to check that totalStaked ≥ totalFrozen should be done both before and after updateTotalFrozen is called to ensure that totalStake is still ≥ totalFrozen. This will serve as a sanit...

UserManager: debtWriteOff() function doesn't update state in comptroller

Handle itsmeSTYJ Vulnerability details Thoughts The debtWriteOff function calls updateTotalFrozen instead of updateTotalFrozen. It is not clear if the comptroller's state should also be updated if totalStaked is modified which it is when you write debt off. If it is then updateTotalFrozen should ...