Description
The FarmingPool's stake function pulls tokens from the user after updating state, but the state update uses set_user_stake which happens after the token transfer in the code flow. However, looking at the actual code, the token transfer happens before set_user_stake.
Current behavior (reversed CEI)
// Pull tokens from caller into the contract.
let stake_token = get_stake_token(&env)?;
token::TokenClient::new(&env, &stake_token).transfer(
&from,
env.current_contract_address(),
&amount,
);
set_user_stake(&env, &from, &new_stake); // State after transferExpected behavior
Follow checks-effects-interactions: persist state before external calls.
Why this matters
If the token transfer succeeds but set_user_stake panics, tokens are locked with no record.
Labels
correctness, farming-pool, hard
Description
The FarmingPool's
stakefunction pulls tokens from the user after updating state, but the state update usesset_user_stakewhich happens after the token transfer in the code flow. However, looking at the actual code, the token transfer happens beforeset_user_stake.Current behavior (reversed CEI)
Expected behavior
Follow checks-effects-interactions: persist state before external calls.
Why this matters
If the token transfer succeeds but
set_user_stakepanics, tokens are locked with no record.Labels
correctness, farming-pool, hard