Umbrella Network 3

In the contract `StakingRewards` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `StakingRewards` the role `rewardsDistribution` has authority over the functions shown in the diagram below. Any compromise to the `rewardsDistribution` account may allow the hacker to take advantage of this authority. 

According to the following codes, the rewards are distributed to users through minting. ```solidity=276 function _getReward(address user, address recipient) internal virtual nonReentrant updateReward(user) returns (uint256 reward) { reward = rewards[user]; if (reward != 0) { rewards[user] = 0; OnDemandToken(address(rewardsToken)).mint(recipient, reward); emit RewardPaid(user, reward); } } ``` The `OnDemandToken(address(rewardsToken))` has a max mint limit. In the function `notifyRewardAmount()`, the variable `maxEverTotalRewards` is used to check whether the `totalRewardsSupply` is over the max mint limit of the `OnDemandTokenaddress(rewardsToken)`. The `totalRewardsSupply` is the total rewards minted to the users. However, the `OnDemandTokenaddress(rewardsToken)` can be minted by the minters. As a result, the reward distribution may fail due to this limit unless the `OnDemandTokenaddress(rewardsToken)` will not be minted by minters directly.