Description

The reward-token list is managed with array, which allows duplicate tokens.

function addTokenToRewardList(IERC20 rewardToken) external onlyManager {
    _checkIsNotZeroAddress(address(rewardToken));
    _updateAllLastRewardPerToken();
    _rewardTokenList.push(rewardToken);

    emit RewardTokenAdded(rewardToken);
}

Impact

While this is not a security issue, it could increase gas costs when iterating over the reward-token list.

Recommendations

Check for duplicate tokens in the addTokenToRewardList function.

Remediation

This issue has been acknowledged by River, and a fix was implemented in commit 479aaa47↗.