Description:
The function stores 'msg.sender' in a state variable 'faucetClaimer' instead of using a local variable. This creates shared mutable state across nested calls (reentrancy) and extra storage writes/gas, and exposes the last claimer publicly.
Impact
Increases reentrancy blast radius (shared state can be observed/relied on by other calls).
Minor privacy leak (publicly reveals last claimer).
Extra gas due to storage writes.
Mitigation:
Replace with a local: address claimer = msg.sender;
Remove the public exposure unless it serves a clear purpose; if needed, emit an event instead.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.
The contest is complete and the rewards are being distributed.