Blast the balloon SC Audit
A user can claim his prizes by calling the claimPrize function. Within this function, there is a check that there are enough funds in the contract for the rewards to be given out.
This is done for better error handing on the dapp and improving gas consumption.
require(address(this).balance >= claimableAmounts[_msgSender()], BlastTheBalloonErrors.NOT_ENOUGH_TOKEN);
This check is however incorrect in the case where there are also pending rewards to be claimed
uint allPrize = claimableAmounts[_msgSender()] + pendingAmount;
// ... code ...
(bool success, ) = payable(_msgSender()).call{value: allPrize}("");
If the addition of pending rewards is more then the balance, the operations will revert further in the execution.
Move the declaration and initialization of the allPrize variable before the balance check and compare this value against the contract balance instead of only the claimableAmounts.
Blast the balloon SC Audit