TempleGold

Summary

getReward function could be called by anyone on behalf of any staker.

This allows a malicious user to cut short the rewards obtained by others,
by calling `getRewards` on their behalf even while the vesting period is ongoing.
This leads to loss of rewards for the staker.

Vulnerability Details

Suppose Alice Stakes on 1st May with a vesting period of 10 days.
fullyVestedAt = 11th May

Bob, can call getReward(Alice, index)
on 2nd May leading to some loss of rewards as Alice does not obtain the full vestingRate multiplier

Impact

Users could lose rewards if another malicious user calls getReward on their behalf,
while the vesting period is ongoing.

Tools Used

Manual Review

Recommendations

Ensure that users cannot call getReward on behalf of other users.