Submitted by kirk-baird, also found by WatchPug
RewardDistributor.sol#L178-#L182
RewardDistributor.sol#L65-#L73
Claiming of the ETH native currency requires token to be set to bribeVault. If the bribeVault is modified in setBribeVault() then users who have ETH rewards will now be considered to have ERC20(bribeVault) tokens. Since bribeVault is not an ERC20 token the transfer() call will fail and the users will not be able to claim their funds.
Consider removing the functionality to change the bribeVault or ensuring all funds have been withdraw i.e. balanceOf(address(this)) == 0 before changing the bribeVault.
kphed (Redacted Cartel) confirmed and commented:
Alex the Entreprenerd (judge) commented:
