First Flight #9: Soulmate

Summary

Staking::claimRewards doesn't consider the dust remaining in the contract when claim amount is greater than remaining token in Staking Vault, thus a user will not be able to claim their rewards if the LoveToken balance in the vault of Staking contract is just less than it.

Vulnerability Details

The vulnerability is present in the Staking contract where it doesn't allow user to claim the amount if it is greater than the balance of vault of Staking contract.

The remaining dust amount cannot be claimed if the claim amount is greater than that, but it should be implemented in such a way that the claim amount for the user should be reduced to the remaining dust amount.

Impact

Dust amount can never be claimed by user if the claim amount is more than remaining amount of Staking Vault contract.

Tools Used

Manual Review

Recommendations

If the claim amount is greater than remaining staking vault's balance then set claim amount to the remaining balance of staking vault.