> For the complete documentation index, see [llms.txt](https://audits.solidgrp.io/gamerse-staking-contract/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://audits.solidgrp.io/gamerse-staking-contract/audit-results/findings.md).

# Findings

## **Issue 01**

| **Type**      | **Severity**                                        | **Location** | **Status**                                                                                                                      |
| ------------- | --------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| Logical Issue | <mark style="color:green;">**Informational**</mark> | `withdraw`   | <mark style="color:red;">**❌**</mark><mark style="color:red;">**&#x20;**</mark><mark style="color:red;">**Not Resolved**</mark> |

**Description**

if \_amount is 0, this function will penalize the user even though they didn't withdraw any tokens.

## **Issue 02**

| **Type**      | **Severity**                                        | **Location**           | **Status**                                       |
| ------------- | --------------------------------------------------- | ---------------------- | ------------------------------------------------ |
| Logical Issue | <mark style="color:green;">**Informational**</mark> | `updateRewardPerBlock` | <mark style="color:green;">**✔️Resolved**</mark> |

**Description**

\_updatePool does nothing when block.number < startBlock, because startBlock will always be less than lastReward.

**Recommendation**

Consider removing the call to \_updatePool.

## **Issue 03**

| **Type**           | **Severity**                                        | **Location**              | **Status**                                                                                                                      |
| ------------------ | --------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Owner Capabilities | <mark style="color:green;">**Informational**</mark> | `updateStartAndEndBlocks` | <mark style="color:red;">**❌**</mark><mark style="color:red;">**&#x20;**</mark><mark style="color:red;">**Not Resolved**</mark> |

**Description**

The owner can set the startBlock to the future, preventing stakers from getting rewards until startBlock is reached.

## **Issue 04**

| **Type**      | **Severity**                               | **Location**  | **Status**                                        |
| ------------- | ------------------------------------------ | ------------- | ------------------------------------------------- |
| Logical Issue | <mark style="color:yellow;">**Low**</mark> | `_updatePool` | <mark style="color:green;">**✔️ Resolved**</mark> |

**Description**

`stakedTokenSupply` may not reflect the actual deposit amount.  Malicious user can send tokens to the contract directly, increasing its balance and reducing the rewards.

**Recommendation**

Use a variable that tracks the staked number of contracts.

## General Notes

* If `rewardHolder` is a contract, the team needs to have a way to externally increase the allowance of the staking contract.
* We recommend adding a timelock to the penalty update functions, to ensure users have enough time to review the changes.