Skip to content

Conversation

@a17
Copy link
Member

@a17 a17 commented Jan 26, 2026

@stability-builder
Copy link

Good luck!

Comment on lines +261 to +303
function notifyRewardAmountToken(
address token,
uint amount
) external updateRewardForToken(token, address(0)) nonReentrant {
/// @dev ensure > 0
require(amount != 0, IncorrectZeroArgument());

XStakingStorage storage $ = _getXStakingStorage();
TokenRewards storage $$ = $.tokenRewards[token];

require($$.allowed, TokenNotAllowed(token));

address _xToken = $.xToken;

/// @dev only callable by xToken and RevenueRouter contract
require(msg.sender == _xToken || msg.sender == IXToken(_xToken).revenueRouter(), IncorrectMsgSender());

/// @dev take the token from a contract to the XStaking
// slither-disable-next-line unchecked-transfer
IERC20(token).safeTransferFrom(msg.sender, address(this), amount);

uint _periodFinish = $$.periodFinish;
uint _duration = $.duration;

if (block.timestamp >= _periodFinish) {
/// @dev the new reward rate being the amount divided by the duration
$$.rewardRate = amount / _duration;
} else {
/// @dev remaining seconds until the period finishes
uint remaining = _periodFinish - block.timestamp;
/// @dev remaining tokens to stream via t * rate
uint _left = remaining * $$.rewardRate;
/// @dev update the rewardRate to the notified amount plus what is left, divided by the duration
$$.rewardRate = (amount + _left) / _duration;
}

/// @dev update timestamp for the rebase
$$.lastUpdateTime = block.timestamp;
/// @dev update periodFinish (when all rewards are streamed)
$$.periodFinish = block.timestamp + _duration;

emit NotifyRewardForToken(token, msg.sender, amount);
}

Check notice

Code scanning / Slither

Block timestamp Low

@a17 a17 linked an issue Jan 26, 2026 that may be closed by this pull request
6 tasks
}

uint amount = IERC20(asset).balanceOf(address(this));
ProcessAssetVars memory v;

Check warning

Code scanning / Slither

Uninitialized local variables Medium

RevenueRouter.processAccumulatedAssets(uint256).v is a local variable never initialized
Comment on lines 487 to 490
function pendingRevenueAsset(address asset) external view returns (uint) {
(, uint amount) = _getRevenueRouterStorage().pendingRevenueAsset.tryGet(asset);
return amount;
}

Check warning

Code scanning / Slither

Unused return Medium

@a17 a17 changed the title πŸ§‘β€πŸ”§ XStaking 2.0.0 draft πŸ§‘β€πŸ”§ XStaking 2.0.0, RevenueRouter 2.0.0 Feb 4, 2026
@a17 a17 merged commit 4b1946d into main Feb 9, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Buy-back rate; revenue on Plasma

1 participant