First Flight #9: Soulmate

if (

tokenAmountToDistribute >=

loveToken.balanceOf(address(airdropVault))

) {

tokenAmountToDistribute = loveToken.balanceOf(

address(airdropVault)

);

} ```

​

This code checks if the calculated ```tokenAmountToDistribute``` is greater than or equal to the remaining balance.

​

If it is, instead of distributing the intended amount, the function sets the distribution amount to the entire remaining vault balance.

​

This logic creates a vulnerability

​

## Vulnerability Details

​

An attacker can exploit it by making repeated claims with small amounts that never exceed the remaining balance.

With each claim, the attacker siphons off a portion of the vault, eventually draining it entirely.

​

## Impact

​

The attacker can slowly drain the ```LoveToken``` vault over time, potentially harming the distribution plan and project sustainability.

​

## Tools Used

​

​

## Recommendations

​

Set a minimum claim threshold larger than the "dust" amount to prevent attackers from exploiting small transfers.