MorpheusAI

Vulnerability Details

In Distribution.sol, the claim() function has callback to the user_ address argument at line#174. Similar instance exist for withdraw() function which calls _withdraw() which uses safeTransfer which is not protected from reentrancy.
It's possible to reenter after the transfer if the token has some kind of callback functionality due to ERC-777 token.

Impact

The callback address can be malicious contract that can which can reenter the function and carry out attack which drains the pool for all the tokens.

Recommendations

Functions with callbacks should have reentrancy guards in place for protection against possible malicious actors both from inside and outside the protocol.
Add a reentrancy guard modifier on the claim() and withdraw() function in Distribution.sol.