Lif3 - vaults - SC

Function `_transferAllRewards()` calculates the reward amount for each reward token and transfers them to the caller. The *require* check on line 536 will revert the entire transaction if one of the reward token balance is not sufficient for the transfer. If the contract is short on one reward token, it could stop all users from claiming their rewards. ```solidity=532 for (uint256 rewardId = 0; rewardId < rewardsLength; ++rewardId) { address reward = rewards[rewardId]; uint256 userRewards = _calculateReward(startOfClaim, endOfClaim, lock.lockTime, lock.amount, reward); if (userRewards > 0) { require( IERC20(reward).balanceOf(address(this)) >= userRewards, "Too little rewards in contract to pay to user" ); address sender = msg.sender; IERC20(reward).safeTransfer(sender, userRewards); emit RewardPaid(sender, userRewards); } } ```

The contract is serving as the underlying entity to interact with third party deposit and reward token contracts, and prb math library. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. Additionally, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to addresses, etc.