Attacker can deposit and claim. Deposit will update the balance
and claim will decrease the contract's WETH balance.
With a large enough deposit an attacker can manipulate the balance
so this condition is always false
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Staking.sol#L65
For subsequent deposits index won't be calculated which means delta will always be zero
https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Staking.sol#L86
Mitigation steps:
Updating balance when claiming
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.