Only getSharesByPooledFlr is used anywhere in src/ (by LibSceptreStakedFlare). getPooledFlrByShares and submit are declared but never called in this repo. submit() is payable and mutating; carrying an unused mutating staking entrypoint on a trusted external contract in an oracle library widens the surface a future careless caller could reach. This is a leaky/over-broad interface for an oracle-only consumer.
File(s): src/interface/IStakedFlr.sol
Lines: 8-10
Proposed fix
Either (a) trim the interface to the single function actually consumed (getSharesByPooledFlr) so the oracle library cannot accidentally invoke staking, or (b) if the broader interface is intentionally mirrored from the upstream sFLR contract, add a file-level comment stating that only getSharesByPooledFlr is used and the others mirror upstream for completeness. No code change is strictly required; documenting intent is the minimum.
Filed by the audit skill (dimension 4-quality). Findings are problems, not fixes — triage decides disposition.
Co-Authored-By: Claude noreply@anthropic.com
Only getSharesByPooledFlr is used anywhere in src/ (by LibSceptreStakedFlare). getPooledFlrByShares and submit are declared but never called in this repo. submit() is payable and mutating; carrying an unused mutating staking entrypoint on a trusted external contract in an oracle library widens the surface a future careless caller could reach. This is a leaky/over-broad interface for an oracle-only consumer.
File(s): src/interface/IStakedFlr.sol
Lines: 8-10
Proposed fix
Either (a) trim the interface to the single function actually consumed (getSharesByPooledFlr) so the oracle library cannot accidentally invoke staking, or (b) if the broader interface is intentionally mirrored from the upstream sFLR contract, add a file-level comment stating that only getSharesByPooledFlr is used and the others mirror upstream for completeness. No code change is strictly required; documenting intent is the minimum.
Filed by the audit skill (dimension 4-quality). Findings are problems, not fixes — triage decides disposition.
Co-Authored-By: Claude noreply@anthropic.com