Lines of code

Vulnerability details

Impact

Reward claimers can call the get accrued reward function multiple times and maybe even drain the contract

Proof of Concept

As we can see there’s no check setting the accrued reward to zero after the rewards have been transferred

Tools Used

Manual review

Recommended Mitigation Steps

Add a setter than sets the reward to zero after the function has been called

Assessed type

Reentrancy

The text was updated successfully, but these errors were encountered:

All reactions