QA Report

[code423n4]

1. LOW: Solidity version pragma uses caret.

Example
Note that this issue is present in pretty much every other contract in the project.

This is a bad practice because ^0.8.11 means that the contracts can be compiled with solidity versions greater than or equal to 0.8.11 but less than 0.9.0. Because any number of solidity versions can be used, it is possible that the contracts are tested with one version of solidity and deployed to production using another version of solidity, which can lead to issues if there are bugs in the solidity compiler.
Instead, the lines should be replaced with pragma solidity 0.8.11; so that 0.8.11 is used in production and testing.

3. informational: safeTransfer to msg.sender in StakingRewards.withdraw should come after all effects.
   location
   This follows the check-effects-interactions pattern, and is good defense-in-depth (since there function uses nonReentrant modifier).

4. Informational: Code layout in StakingRewards doesn't obey conventions, events are on the bottom.
   Example
   They should come before functions.
   Putting events at the end is inconsistent with the other contracts in this repo.
   It is also inconsistent with solidity's standard conventions

[GalloDaSballo]

LOW: Solidity version pragma uses caret.
Disagree, the version can be known

informational: safeTransfer to msg.sender in StakingRewards.withdraw should come after all effects.
The sponsor chose to use nonReentrant, I can make the argument that the propose solution is still vulnerable as the function connects to more than one external contract, for that reason I must disagree

Informational: Code layout in StakingRewards doesn't obey conventions, events are on the bottom.
Agree with this as a coding convention

[GalloDaSballo]

++