TreasuryBTC::claimRewards can be manipulated due to balanceOf()

Reward claim in TreasuryBTC::claimRewards and TreasuryBTC::claimMultipleRewards is calculated using live balances at claim time instead of using the NXL token balance at the snapshot creation time. The same NXL tokens can be transferred across different addresses and used to claim rewards multiple times for the same snapshot, draining protocol funds.

Vulnerable Scenario:

The following steps help understand the issue:

• Address A with NXL token balance calls TreasuryBTC::claimRewards and successfully claims tokens.
• Address A sends his NXL balance to another address B. Address B calls TreasuryBTC::claimRewards. This will also work because the function uses live balances of an address.
• An attacker can repeat this multiple times to drain contract stablecoin balance.

Drain of protocol funds.

Make use of user NXL token balance at the snapshot creation time using ERC20Snapshot:

balanceOfAt(user, snapshotId)
totalSupplyAt(snapshotId)

Nexalo: Claim rewards system removed.

Zealynx: We recommend to follow recommendation instead of removing chore feature.