Beedle - Oracle free perpetual lending

Summary

Withdraw function should only be callable by owner of token.

Vulnerability Details

In the withdraw() in Staking.sol , there's no check to ensure that the caller is the owner of the tokens they're trying to withdraw. This could allow anyone to call the function and withdraw tokens from any account. Which can cause anyone to call the function with desired amount and withdraw that amount.

Impact

Loss of funds from the 'Staking.sol' contract.

Tools Used

Manual review

Recommendations

Add a if statement at the start of the function to ensure that balances[msg.sender] >= _amount.