poolHelper Manual Review Findings

POO-01M: Incorrect User Incentives

Description:

The harvest function will invoke harvest with the true flag on isUser, thereby acquiring an incentive token amount. However, this token amount is not transferred to the original user thereby remaining locked in the contract.

Example:

Copy
68function harvest() public {
69    IMainStaking(mainStaking).harvest(depositToken, true, true);
70}

Recommendation:

We advise it to be properly transferred to the user to ensure proper incentivization of the harvest call.

Alleviation:

The full XPTP balance is now transferred to the caller of the function.