User can drain all the reward tokens from the contract, including the tokens he is not entitled to.
Summary
The Staking contract has a reentrancy vulnerability in the claim() function. This vulnerability allows an attacker to claim rewards multiple times, draining the contract of its funds.
Vulnerability Details
The claim() function does not follow CEI pattern and updates the user's index and claimable rewards after transferring the rewards to the user.
This means that the attacker contract can call the claim() function multiple times right after hitting receive() function on malicious contract, and thus keep draining the tokens from contract.
It is recommended to make state changes before external calls and effects.
Impact
High: User can drain all the reward tokens from the contract, including the tokens he is not entitled to.
Tools Used
Manual
Recommendations
Use MUTEX or OpenZeppelin's reentrancy guard.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.