Summary

Vulnerability Details

The contract uses assert statements to check the success of token transfers via extcall to the ERC-20 token contract:

_success: bool = extcall IERC20(self.token).transfer(user, claimable)
assert _success, "Transfer failed"

While assert is useful for catching unexpected errors, it does not allow for graceful error handling. If the transfer fails, the transaction will revert entirely, potentially resulting in a poor user experience. Furthermore, assert should only be used for internal checks, not for external calls.

Impact

Tools Used

manual reveiw

Recommendations

Replace the assert with a more user-friendly error-handling mechanism, such as require or a try/catch block (if supported). This would allow for better control over failure scenarios, providing more informative feedback to users without fully reverting the transaction.