Submitted by cmichel
The RocketJoeStaking.lastRewardTimestamp is initialized to zero. Usually, this does not matter as updatePool is called before the first deposit and when joeSupply = joe.balanceOf(address(this)) == 0, it is set to the current time.
However, if a user first directly transfers Joe tokens to the contract before the first updatePool call, the block.timestamp - lastRewardTimestamp = block.timestamp will be a large timestamp value and lots of rJoe will be minted (but not distributed to users).
Even though they are not distributed to the users, inflating the rJoe total supply might not be desired.
Consider tracking the actual total deposits in a storage variable and using this value instead of the current balance for joeSupply.
This way, transferring tokens to the contract has no influence and depositing through deposit first calls updatePool and initializes lastRewardTimestamp.
cryptofish7 (Trader Joe) confirmed and commented:
