Beedle - Oracle free perpetual lending

Summary

Rentrancy attack possible in claim() of staking.sol

Vulnerability Details

The Rentrancy attack possible as it first transfers the rewards to msg.sender and afterwards updates the mapping of claimable.

Impact

All the reward tokens could be drained from the contract through re-entracy attack.

Tools Used

Manual review

Recommendations

First update the state of mapping and then transfer the reward tokens to msg.sender so no re-entracy attack would be possible.