Inability to collect any rewards under certain configurations
A specific sequence of configuration changes (originally identified as Critical, downgraded to Low after team discussion) left users unable to collect any rewards. The downgrade reflected the narrow reachability of the configuration combination.
Description
A specific combination of configuration changes triggered a state in which no user could collect rewards from the affected pool. Originally classified Critical, the finding was downgraded to Low after discussion with the Neverland team, reflecting the narrow reachability of the offending configuration sequence in practice.
Impact
If the configuration combination is reached, all reward claims fail. Recovery requires an administrative reset.
Recommendation
Add a configuration-state invariant check that rejects any update that would leave the contract unable to honor reward claims. Add tests exercising the configuration sequences identified during audit.
Composable Security ID: NRL-6c19a5e-L08. Neverland Money: Fixed. Composable Security: Fix verified during retest.