infrared-contracts[PR-600]

Context: See below.

Description/Recommendation:

1. InfraredV1_5.sol#L7-L9 - The Errors and UUPSUpgradeable imports are unused and can be removed.

2. RewardsLib.sol#L434 - Typo, "infarred" -> `Infrared"

3. RewardsLib.sol#L146 - Typo, recepient should be recipient.

Recommendation: Fixed in commit e786416.

Cantina: Verified.

Context: InfraredV1_5.sol#L23-L26

Description:

InfraredV1_5.claimExternalVaultRewards() does not perform any access control checks on msg.sender. This allows anyone to claim BGT rewards on behalf of any user, as long as that user has set the InfraredV1_5 contract as its operator in a vault.

While this does not cause any issues as the iBGT rewards claimed are still sent to the user, it exposes unnecessary risk to the contract.

Recommendation:

Consider including access control in claimExternalVaultRewards(). For example, only allow the function to be called by the protocol's keeper through the onlyKeeper modifier, which would be consistent with reward functionality in previous versions (e.g. claimBGTIncentives() in InfraredV1_4).

Recommendation: Fixed in commit 69019f8.

Cantina: Verified.