PeriodicPrizeStrategy - RNG failure can lock user funds
To prevent manipulation of the `SortitionSumTree` after a requested random number enters the mempool, users are unable to withdraw funds while the strategy contract waits on a random number request between execution of `startAward()` and `completeAward()`.\\nIf an rng request fails, however, there is no way to exit this locked state. After an rng request times out, only `startAward()` can be called, which will make another rng request and re-enter the same locked state. The rng provider can also not be updated while the contract is in this state. If the rng provider fails permanently, user funds are permanently locked.\\n`requireNotLocked()` prevents transfers, deposits, or withdrawals when there is a pending award.\\n```\\nfunction beforeTokenTransfer(address from, address to, uint256 amount, address controlledToken) external override onlyPrizePool {\\n  if (controlledToken == address(ticket)) {\\n    \\_requireNotLocked();\\n  }\\n```\\n\\n```\\nfunction \\_requireNotLocked() internal view {\\n  uint256 currentBlock = \\_currentBlock();\\n  require(rngRequest.lockBlock == 0 || currentBlock < rngRequest.lockBlock, "PeriodicPrizeStrategy/rng-in-flight");\\n}\\n```\\n\\n`setRngService()` reverts if there is a pending or timed-out rng request\\n```\\nfunction setRngService(RNGInterface rngService) external onlyOwner {\\n  require(!isRngRequested(), "PeriodicPrizeStrategy/rng-in-flight");\\n```\\n
Instead of forcing the pending award phase to be re-entered in the event of an rng request time-out, provide an `exitAwardPhase()` function that ends the award phase without paying out the award. This will at least allow users to withdraw their funds in the event of a catastrophic failure of the rng service. It may also be prudent to allow the rng service to be updated in the event of an rng request time out.
```\\nfunction beforeTokenTransfer(address from, address to, uint256 amount, address controlledToken) external override onlyPrizePool {\\n  if (controlledToken == address(ticket)) {\\n    \\_requireNotLocked();\\n  }\\n```\\n