0xLeveler - user tokens can be claimed by anyone

[sherlock-admin4]

0xLeveler

High

user tokens can be claimed by anyone

Summary

while a user submits the claimParams the tokens are sent to the caller of the function, which is anyone that can see the transaction in the mempool and frontrun the actual owner.

Root Cause

This is the entire claim function with insufficient validation
https://github.com/sherlock-audit/2024-11-vvv-exchange-update/blob/main/vvv-platform-smart-contracts/contracts/vc/VVVVCTokenDistributor.sol#L106-L136

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1. user calls the claim function with valid claim params signed offchain by the signer.
2. any other user can see this claim in the mempool and submit it to withdraw all the user tokens due to lack of validation

Impact

Loss of investment returns for the user

PoC

No response

Mitigation

add validation to ensure that the claim is for the kycAddress that invested in the first place.