Beedle - Oracle free perpetual lending

Summary

The claim() function in Staking.sol updates state variables after transfer().

Not following the CEI pattern, and although I'm still but unsure whether reentrancy is possible or not(not?), the dangerous line is this one, which currently is executed after the transfer():

claimable[msg.sender] = 0;

Vulnerability Details

n/a

Impact

If the claim() function was reentrancy vulnerable, a rogue claimer/attacker could claim all the WETH in the staking contract.
At the very least, this lack of following CEI pattern can open up the function to future attack vectors if this goes unfixed.

Tools Used

VSC, manual.

Recommendations

function claim() external {
    updateFor(msg.sender);
    uint256 _claimable = claimable[msg.sender];
    claimable[msg.sender] = 0;
    WETH.transfer(msg.sender, _claimable);
    balance = WETH.balanceOf(address(this));
}