## Low severity ### [L-1] The contract would lead to less reward for users if one of the reward tokens is VAPE token #### **Context** - https://github.com/VaporFi/vapordex-contracts/blob/staging/contracts/StableVapeStaking.sol#L41-L48 #### **Description** When the staking token is the same as the reward token. This kind of liquidity pool is popular among DeFi platforms because it directly helps increase the usability of that token. The contract takes many factors such as the user’s shares and the total amount of tokens staked to help calculate the reward for each user. In `updateReward()`, the total amount of token staked for a specific pool is identified using the balance of that token in the contract. If the pool allows the use of the reward token for staking, the amount stored in will be incorrectly inflated due to the reward minted to the contract, leading to the reward miscalculation. This issue has a direct impact on the users because the miscalculation will lower the benefits that the users should receive, which will be continually reduced based on the rewards that have not been claimed from the contract by other users. #### **Recommended Mitigation Steps** Prevent the pool with the same staking token as the reward token from being added. ## Informational severity ### [I-1] Lack of indexed paramter in the event #### **Context** - https://github.com/VaporFi/vapordex-contracts/blob/staging/contracts/StableVapeStaking.sol#L83-L86 #### **Description** Event `RewardTokenAdded` and `RewardTokenRemoved` are emitted when reward tokens are added and removed respectively. These events do not used indexed parameters which won't help them in indexing. #### **Recommended Mitigation Steps** Consider using indexed parameter for above events.