fix(rewards): claimRewardsAll isolates griefing tokens via try/catch

[tangletools]

Summary

Single security hardening fix: claimRewardsAll should not be lockable by a griefing ERC20 in the pending-rewards set.

The bug

claimRewardsAll iterates every token in _pendingRewardTokens[operator] and inlines _claimRewardsToken for each. A token whose transfer reverts (paused token, gas-bomb hook, custom revert, broken upgrade) used to abort the entire sweep, locking the operator out of every other claim — including normal, well-behaved tokens. The pre-existing fix path was "remove the griefing token off-chain", which is not actionable: the protocol has no admin route to evict a token from an operator's pending set.

The fix

Each token is now claimed in an isolated self-call (address(this).call(_claimRewardsTokenSafe(account, token))) wrapped in try/catch:

• Normal tokens: same behavior as before — pending zeroed, transfer fires, event emitted, token removed from set.
• Griefing tokens: the self-call reverts in isolation, the outer try/catch catches it, the rest of the sweep continues, a RewardsClaimSkipped(account, token) event is emitted so indexers and the operator can identify the offending token and pursue the off-chain mitigation (e.g., transfer the pending balance to a different recipient via a one-off claim once the token is unpaused).

The self-call helper is gated by msg.sender == address(this) so external callers cannot reach it directly. The outer nonReentrant guard on claimRewardsAll still holds for the whole sweep — the inner self-call helper is intentionally not nonReentrant so the diamond can route it back into the same facet via delegatecall.

Single-token claims (claimRewards(), claimRewards(token), claimRewardsBatch) are unchanged. A user explicitly asking to claim one specific token SHOULD see the underlying revert — that is the diagnostic signal. Only the sweep path needs griefing isolation.

Test plan

• test_ClaimRewardsAll_SkipsGriefingTokenAndCompletesRest (PaymentEdgeCases.t.sol) — full end-to-end: operator with two pending tokens, one of which reverts on transfer. After claimRewardsAll:
  • Normal token's balance lands at the operator.
  • Normal token cleared from pending-rewards set.
  • Griefing token's pending balance preserved (operator can retry later).
  • Griefing token remains in rewardTokens(operator).
  • Single-token claimRewards(griefingToken) still reverts (preserves single-claim semantics).
  • RewardsClaimSkipped event emitted for the griefing token.
• Full regression: 1,455 / 1,455 tests pass.
• CI green

Storage / ABI

• No storage layout changes.
• Same claimRewardsAll selector, same return type (void). Behavior strictly more permissive than before — never blocks legitimate claims.
• One new selector _claimRewardsTokenSafe(address,address) registered on TanglePaymentsRewardsFacet. Gated by msg.sender == address(this) so external callers see Errors.Unauthorized().
• One new event: RewardsClaimSkipped(address indexed account, address indexed token) — indexer-friendly signal that the sweep skipped a token.