SPythia lost 21 ETH

Anyone who holds SPythia token can call “claimRewards” function without any locking period. Hacker could call “claimRewards” function several times by moving tokens from one account to another account. Reward amout should be calculated using locked period.