Real Glossy Rhino
Medium
The claimRewardOnBehalf function in the contract allows anyone to claim rewards on behalf of a deposit owner or claimer if they possess a valid _signature. However, there are no restrictions requiring the caller of the function to match the deposit.owner or deposit.claimer. This creates a significant vulnerability, as anyone with access to a valid _signature can claim rewards without being deposit.owner or deposit.claimer.
Anyone with access to a valid _signature can claim rewards without being the deposit owner or claimer.
Manual Review, Foundry
Only deposit.owner or deposit.claimer should be able to call claimRewardOnBehalf