Fix/streak bonus cooldown

[rabsqueen]

Summary

Fixed claim_streak_bonus so eligible members cannot repeatedly claim the same streak bonus across transactions. The implementation adds claim tracking and enforces the streak reward lifecycle to prevent unlimited bonus accumulation.

Changes

• Added per-member streak bonus claim tracking.
• Added validation to prevent a member from claiming the bonus more than once for the same eligible streak/round.
• Updated the streak reward lifecycle so a successfully claimed bonus cannot immediately be claimed again using the same streak state.
• Preserved the existing minimum streak eligibility requirement of 3.
• Added explicit error handling for repeated or already-claimed streak bonus attempts.
• Kept the existing event emission for successful streak bonus claims.
• Added regression tests covering first-time claims, repeated claims, claim eligibility, and independent member claims.
• Kept the implementation compatible with the existing referral bonus claim-tracking pattern.

Security Impact

This closes a potential treasury-drain vector in claim_streak_bonus.

Previously, a member with a qualifying streak could invoke the function repeatedly because no state recorded that the reward had already been claimed. The new claim guard makes the reward stateful and prevents repeated claims for the same streak/round.

The protection also remains important once actual token transfers are enabled, where unrestricted repeated claims could result in direct loss of circle or treasury funds.

Validation

• Verified an eligible member can successfully claim the streak bonus once.
• Confirmed subsequent attempts for the same streak/round are rejected.
• Verified members with insufficient streaks cannot claim the bonus.
• Confirmed separate members maintain independent claim state.
• Verified successful claims continue to emit StreakBonusPaid.
• Added regression coverage to prevent the vulnerability from being reintroduced.
• Ran the relevant Circle contract tests and checks.

Acceptance Criteria

• Prevent repeated claim_streak_bonus calls from producing additional rewards for the same streak/round.
• Track streak bonus claim state per member.
• Enforce the existing minimum streak requirement.
• Reject already-claimed bonus attempts.
• Preserve successful bonus event emission.
• Add regression tests for repeated-claim protection.

closes #172
closes #210
closes #212
closes #211

[drips-wave]

@rabsqueen Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits