Audit - Staking M2: No update will ever be possible for tranches

[roxdanila]

updateTranches() provides an important functionality as it updates the accounting of the rewards and shares. It is called in almost every other function that makes a deposit, a withdrawal, stake allocation and deallocation and many other operations.

However, the function will return immediately if the value of firstActiveBucketId is 0. This is done to prevent updates when a pool is new. But since this variable is initialized with 0 and only updated later in the same function, the updating code is never executed, leading the function to always return.

StakingPool::updateTranches():213

// Dedaub: `firstActiveBucketId` will always be 0
  uint _firstActiveBucketId = firstActiveBucketId;
  ...


  // skip if the pool is new
  if (_firstActiveBucketId == 0) {
    return;
  }
  ...
  if (_rewardsSharesSupply == 0) {
      firstActiveBucketId = currentBucketId;
      ...
  }
  ...
  firstActiveTrancheId = _firstActiveTrancheId;
  firstActiveBucketId = _firstActiveBucketId;