MorpheusAI

Summary : The contract is vulnerable to an arbitrary from address being passed to transferFrom, which can lead to loss of funds.

Vulnerability Details : The transferFrom function in Distribution.sol allows an arbitrary from address to be specified. This means anyone can transfer tokens from any address if an approval is made.

Impact : This vulnerability could lead to loss of funds for users. An attacker could drain funds from user accounts by getting approval and specifying their accounts as the from address.

Tools Used : aderyn

Recommendations :

Validate that msg.sender is the from address being passed to transferFrom.

Use safeTransferFrom over transferFrom to prevent reentrancy attacks.

Add proper access controls and authorization to the transferFrom function