Line: https://github.com/Cyfrin/2024-08-fjord/blob/6614c7f97f6fb020f1a980215e7579615027ba8e/src/FjordPoints.sol#L253

The claimPoints function allows users to claim their accumulated points, but it mints new tokens to the user's address (_mint(msg.sender, pointsToClaim)) before updating the user's pendingPoints balance (userInfo.pendingPoints = 0).

• Risk: A malicious user could reenter the claimPoints function before their balance is updated, potentially claiming more points than they are entitled to.

• Solution: To prevent reentrancy, the contract should update the user's pendingPoints balance to zero before minting the tokens, or alternatively, use the ReentrancyGuard modifier from OpenZeppelin.