Submitted by 0xliumin, also found by cmichel, leastwood, and pauliax
Any user can withdraw all the funds from the shelter. This is done by calling withdraw repeatedly until all funds are drained. You only need to have a small share.
Even if the claimed mapping was checked, there would still be a vulnerability. This is because the claimed mapping is updated with the _to address, not the msg.sender address.
Remediation is to change the _to to msg.sender.
Shelter.sol#L55
leekt (Concur) confirmed
Alex the Entreprenerd (judge) increased severity to High and commented:
