staking-receipt-tokens

# Skill: Staking Receipt Token Analysis > **Type**: Thought-template (instantiate before use) > **Research basis**: Donation attacks via unsolicited token transfers ## Trigger Patterns ``` delegation|staking.*receipt|liquid.*staking|getLiquidRewards|unbond| stake.*share|validator|deposit.*voucher|withdraw.*voucher|claimReward ``` ## Reasoning Template ### Step 1: Identify Receipt Tokens - In {CONTRACTS}, find all external calls that return tokens - For each, determine: - What token type is returned? (shares, vouchers, receipts, LP tokens) - Is the returned token ERC20-compatible? - Does the protocol hold these tokens? ### Step 2: Check Transferability - For each receipt token {RECEIPT_TOKEN}: - Can it be acquired externally? (stake directly with {EXTERNAL_STAKING}) - Can it be transferred via standard `transfer()`/`transferFrom()`? - Can anyone transfer it to {PROTOCOL_CONTRACT} unsolicited? ### Step 2b: External Token Transferability For each EXTERNAL staking/delegation token the protocol interacts with (not just the protocol's own receipt token): 1. Is it ERC20-transferable? (check if extends IERC20/IERC20Upgradeable) 2. Can it be transferred TO the protocol contract unsolicited (without calling deposit/stake)? 3. If YES to both: a. Does the protocol iterate over these tokens or their sources? (gas DoS from many unsolicited transfers) b. Does `getTotalStake(protocol)` or equivalent change? (accounting impact on withdrawal calculations) c. Does `...