First Flight #9: Soulmate

Summary

User can Staking::deposit amount of tokens and then Staking::claimRewards. If it has been more than a week before claiming, the user will receive a reward. After claiming, the user can withdraw the deposited amount using Staking::withdraw.

Vulnerability Details

The user can claim rewards without keeping tokens staked, potentially allowing for unintended rewards.

Impact

The user does not need to maintain staked tokens to claim rewards, leading to a loss in the intended staking mechanism's functionality.

Tools Used

Manual Auditing

Recommendations

Consider implementing a mapping to keep track of user deposits and withdrawals, similar to SushiSwap's MasterChef contract. This approach will provide a more robust record of user actions and help ensure the integrity of the staking system.