BathToken uninitialized rewardsVestingWallet leading to loss of funds

Lines of code Vulnerability details Impact Contract BathToken.sol implements distributeBonusTokenRewards function that allows distributing non-underlying bath token incentives to pool withdrawers. In case of rewardsVestingWallet being set implementation triggers release function of...

rewardsVestingWallet is never initialized

Lines of code Vulnerability details Impact rewardsVestingWallet in BathToken is never initialized thus release will never happen: /// @notice Address of the OZ Vesting Wallet which acts as means to vest bonusToken incentives to pool HODLers IBathBuddy public rewardsVestingWallet; When calling...

There is no way to set the rewardsVestingWallet (IBathBuddy) in BathToken contract

Lines of code Vulnerability details rewardsVestingWallet IBathBuddy helps in releasing or distributing vested bonus tokens during withdrawals. There is currently no function to set it in BathToken contract. rewardsVestingWallet IBathBuddy remains as address0 and is unusable. Impact Admin can not...