Submitted by WatchPug, also found by BowTiedWardens, cccz, minhquanym, parashar, pashov, shung, and zzzitron
Staking.sol#stake() is a public function and you can specify an arbitrary address as the _recipient.
When warmUpPeriod > 0, with as little as 1 wei of YIELDY_TOKEN, the _recipients warmUpInfo will be push back til epoch.number + warmUpPeriod.
Consider changing to not allow deposit to another address when warmUpPeriod > 0.
Dravee (warden) commented:
moose-code (judge) increased severity to High and commented:
toshiSat (Yieldy) confirmed
