First Flight #9: Soulmate

Summary

Staking::claimRewards does not check if the stakingVault has enough loveToken to transfer to the user. This could lead to a DoS attack if the stakingVault runs out of loveToken.

Vulnerability Details

An attacker can drain the stakingVault of loveToken by calling Staking::claimRewards repeatedly until the vault runs out of loveToken. This would prevent other users from claiming their rewards.

Impact

If the stakingVault runs out of loveToken, the Staking::claimRewards will fail for all users because it attempts to transfer tokens from an empty vault. This could be used as a DoS attack vector if someone can manipulate the vault's balance.

Tools Used

Manual Review with Audit Wizard

Recommendations

Implement CEI to ensure that the stakingVault has enough loveToken to transfer to the user.