cachedUserRewards variable is never reset, so user can steal all rewards
cachedUserRewards variable is never reset, so user can steal all rewards\\nWhen user wants to withdraw then `_withdrawUpdateRewardState` function is called. This function updates internal reward state and claims rewards for user if he provided `true` as `claim_` param.\\n```\\n            if (rewardDebtDiff > userRewardDebts[msg.sender][rewardToken.token]) {\\n                userRewardDebts[msg.sender][rewardToken.token] = 0;\\n                cachedUserRewards[msg.sender][rewardToken.token] +=\\n                    rewardDebtDiff -\\n                    userRewardDebts[msg.sender][rewardToken.token];\\n            } else {\\n                userRewardDebts[msg.sender][rewardToken.token] -= rewardDebtDiff;\\n            }\\n```\\n\\nWhen user calls claimRewards, then `cachedUserRewards` variable is added to the rewards he should receive. The problem is that `cachedUserRewards` variable is never reset to 0, once user claimed that amount.\\nBecause of that he can claim multiple times in order to receive all balance of token.
Once user received rewards, reset `cachedUserRewards` variable to 0. This can be done inside `_claimInternalRewards` function.
User can steal all rewards
```\\n            if (rewardDebtDiff > userRewardDebts[msg.sender][rewardToken.token]) {\\n                userRewardDebts[msg.sender][rewardToken.token] = 0;\\n                cachedUserRewards[msg.sender][rewardToken.token] +=\\n                    rewardDebtDiff -\\n                    userRewardDebts[msg.sender][rewardToken.token];\\n            } else {\\n                userRewardDebts[msg.sender][rewardToken.token] -= rewardDebtDiff;\\n            }\\n```\\n