Summary:

https://github.com/CodeHawks-Contests/2025-02-vyper-vested-claims/blob/main/src/VestedAirdrop.vy#L136

_success: bool = extcall IERC20(self.token).transfer(user, claimable)

extcall in claim and rescue_tokens is Unsafe

Impact:

extcall (low-level call) does not revert on failure, which can lead to silent failures.

Tools Used: none

Recommendations

Fix: Use assert IERC20(self.token).transfer(user, claimable), "Transfer failed" instead.