Core Contracts

Summary

The claimRewards() function allows users to repeatedly claim the same rewards within the same period due to a missing update to their last claim timestamp or reward balance. This enables them to drain the reward pool unfairly.

Vulnerability Details

• The function claimRewards() calls _calculatePendingRewards() to determine the rewards owed to a user.

• However, after transferring the rewards, the contract does not update the user's last claim time or reduce the pending rewards.

• This allows a user to call claimRewards() multiple times within the same period and receive the same rewards repeatedly.

Impact

Users can repeatedly claim rewards, leading to an unfair distribution and rapid depletion of the reward pool.

Tools Used

Manual code review

Recommendations

Update last claim timestamp after rewards are transferred.