Description: A malicious user could leverage a flash loan in order to drain all the funds from the vault by exploiting the logic in the staking pool. The Staking.sol::claimRewards function checks the amount that a user is eligible to withdraw based on the amount deposited multiplied by the number of weeks the user has staked.

Impact: All the funds from the vault could be drained.

Proof of concept:

1. Imagine a pool that has 1999 tokens.

2. Attacker deposits 1 token.

3. Two weeks pass.

4. Attacker takes a flash loan and buys 2000 tokens.

5. Attacker deposits the funds.

6. Now the pool holds 4000 tokens, and the attacker is eligible to claim 2001 (total tokens deposited) times 2 weeks, because he staked his first token 2 weeks ago, which means 4002 tokens.

7. Attacker calls claimRewards function, and drains the vault before returning the flash loan.

8. Pool has 0 tokens now, and the attacker has 2000 tokens after returning the flash loan.

Recommended mitigation: A potential mitigation strategy involves tracking the amount staked and the time it was staked for, ensuring rewards are calculated based on "staked time" rather than only looking at the current deposited amount. This involves rethinking the logic of the function