Summary

External users can claim staking rewards of LoveTokens in StakingVault without being a couple of soulmates (or a soulmate at all). As there is no check if msg.sender is a soulmate, external user can claim staking rewards corresponding to tokenId 0

Vulnerability Details

The attacker deposit some LoveTokens in the Staking.sol contract
The attacker can claim an staking rewards without being a soulmate:

As the attacker isn't a soulmate soulmateContract.ownerToId(msg.sender) this will be equal to 0 , the next steps will happens like the attacker is the owner of token 0
lastClaim[msg.sender] is then equals to the creationTimestamp of token 0

Then the uint256 amountToClaim = userStakes[msg.sender] * timeInWeeksSinceLastClaim; is not 0, resulting in

to transfer tokens without reverting

Impact

Anyone can claim staking rewards corresponding to token 1

To go further : a loop doing the exploit starting with 1 LoveToken the 1rst week would need only 29 iterations to empty the 500 000 000 tokens (creating a new account each time)

Tools Used

Manual review

Recommendations

Check if msg.sender has a soulmate