claimCOMPAndTransfer() COMP may be locked into the contract
Malicious users can keep front-run `claimCOMPAndTransfer()` to trigger `COMPTROLLER.claimComp()` first, causing `netBalance` in `claimCOMPAndTransfer()` to be 0 all the time, resulting in `COMP` not being transferred out and locked in the contract\\n`claimCOMPAndTransfer()` use for "Claims COMP incentives earned and transfers to the treasury manager contract" The code is as follows:\\n```\\n    function claimCOMPAndTransfer(address[] calldata cTokens)\\n        external\\n        override\\n        onlyManagerContract\\n        nonReentrant\\n        returns (uint256)\\n    {\\n        uint256 balanceBefore = COMP.balanceOf(address(this));\\n        COMPTROLLER.claimComp(address(this), cTokens);\\n        uint256 balanceAfter = COMP.balanceOf(address(this));\\n\\n        // NOTE: the onlyManagerContract modifier prevents a transfer to address(0) here\\n        uint256 netBalance = balanceAfter.sub(balanceBefore);   //<-------@only transfer out `netBalance`\\n        if (netBalance > 0) {\\n            COMP.safeTransfer(msg.sender, netBalance);\\n        }\\n\\n        // NOTE: TreasuryManager contract will emit a COMPHarvested event\\n        return netBalance;\\n```\\n\\nFrom the above code, we can see that this method only turns out the difference value `netBalance` But `COMPTROLLER.claimComp()` can be called by anyone, if there is a malicious user front-run this transcation to triggers `COMPTROLLER.claimComp()` first This will cause thenetBalance to be 0 all the time, resulting in `COMP` not being transferred out and being locked in the contract.\\nThe following code is from `Comptroller.sol`\\n```\\n    function claimComp(address holder, CToken[] memory cTokens) public { //<----------anyone can call it\\n        address[] memory holders = new address[](1);\\n        holders[0] = holder;\\n        claimComp(holders, cTokens, true, true);\\n    }\\n```\\n
Transfer all balances, not using `netBalance`
`COMP` may be locked into the contract
```\\n    function claimCOMPAndTransfer(address[] calldata cTokens)\\n        external\\n        override\\n        onlyManagerContract\\n        nonReentrant\\n        returns (uint256)\\n    {\\n        uint256 balanceBefore = COMP.balanceOf(address(this));\\n        COMPTROLLER.claimComp(address(this), cTokens);\\n        uint256 balanceAfter = COMP.balanceOf(address(this));\\n\\n        // NOTE: the onlyManagerContract modifier prevents a transfer to address(0) here\\n        uint256 netBalance = balanceAfter.sub(balanceBefore);   //<-------@only transfer out `netBalance`\\n        if (netBalance > 0) {\\n            COMP.safeTransfer(msg.sender, netBalance);\\n        }\\n\\n        // NOTE: TreasuryManager contract will emit a COMPHarvested event\\n        return netBalance;\\n```\\n