Summary

Airdrop::claim and Staking::claimRewards perform a multiplication on the result of a division (divide before multiply)

Vulnerability Details

Solidity's integer division truncates.

• numberOfDaysInCouple = (block.timestamp - soulmateContract.idToCreationTimestamp(soulmateContract.ownerToId(msg.sender))) / daysInSecond (src/Airdrop.sol#56-59)

• amountAlreadyClaimed >= numberOfDaysInCouple * 10 ** loveToken.decimals() (src/Airdrop.sol#64-65)

• tokenAmountToDistribute = (numberOfDaysInCouple * 10 ** loveToken.decimals()) - amountAlreadyClaimed (src/Airdrop.sol#68-69)

• timeInWeeksSinceLastClaim = ((block.timestamp - lastClaim[msg.sender]) / 604800) (src/Staking.sol#81-82)

• amountToClaim = userStakes[msg.sender] * timeInWeeksSinceLastClaim (src/Staking.sol#90-91)

Impact

Performing division before multiplication can lead to precision loss.

Tools Used

Slither

Recommendations

Consider ordering multiplication before division.