Tapioca DAO: Attacker can pass duplicated reward token addresses to steal the reward of contract `twTAP.sol`

A vulnerability in Tapioca DAO's twTAP contract allows attackers to drain contract reward balances by passing duplicate reward token addresses. The internal function responsible for processing reward claims snapshots claimable amounts before iterating over a c …