Permanent reward loss for burnt veNFTs
Rewards accrued to veNFTs that were later burned could not be recovered, causing user funds and treasury revenue to be permanently locked in the contract.
Description
The reward accounting tied accrued rewards to the veNFT token. When the token was burned, the rewards remained accounted to a token ID that no longer existed, with no recovery mechanism. The funds were not destroyed, but they became unreachable by any claim or admin path.
Impact
User funds permanently locked in the contract. Treasury revenue permanently diverted from circulation. No recovery path without a contract upgrade.
Recommendation
On veNFT burn, either claim all pending rewards to the owner address before the burn completes, or route accrued rewards to the protocol treasury via an explicit administrative path. Add tests asserting that no funds become unreachable when a veNFT is burned.
Composable Security ID: NRL-6c19a5e-H03. Neverland Money: Fixed. Composable Security: Fix verified during retest.