user's reward loss because of incorrect rewardsTokens in PirexRewards contract when rewardsTokens are not configured yet or configured incorrectly
Audit: 2022-11-redactedcartel-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexRewards.sol#L373-L417
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexRewards.sol#L338-L366
https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/PirexGmx.sol#L739-L816


# Vulnerability details

## Impact
`PirexRewards` contract start tracking `gmxBaseReward` and `pxGmx` as rewardsToken for `pxGmx` and `pxGlp` as producerTokens from the begining of contract deployment because this values hardcoded in `claimRewards()` function of `PirexGmx` But those primary rewardTokens didn't get inserted to `PirexRewards` contract state from the beginning and `owner` should add them later. When `rewardTokens` state are wrong in `PirexRewards` contract (`gmxBaseReward` and `pxGmx` is not in list), users calling `PirexReward.claim()` would lose their rewards because contract set `userStates[user].rewards = 0`. This condition can happen in contract early stage or when `owner` tries to change or update `rewardTokens`. Those primary `rewardTokens` should be hardcoded and added to rewards token list when contract get initialized because their values are hardcoded in `PirexGmx` and they should be hardcoded in `PirexRewards` too.

## Proof of Concept
This is function `claim()` code in `PirexRewards` contract:
```
    function claim(ERC20 producerToken, address user) external {
        if (address(producerToken) == address(0)) revert ZeroAddress();
        if (user == address(0)) revert ZeroAddress();

        harvest();
        userAccrue(producerToken, user);

        ProducerToken storage p = producerTokens[producerToken];
        uint256 globalRewards = p.globalState.rewards;
        uint256 userRewards = p.userStates[user].rewards;

        // Claim should be skipped and not reverted on zero global/user reward
        if (globalRewards != 0 && userRewards != 0) {
            ERC20[] memory rewardTokens = p.rewardTokens;
            uint256 rLen = rewardTokens.length;

            // Update global and user reward states to reflect the claim
            p.globalState.rewards = globalRewards - userRewards;
            p.userStates[user].rewards = 0;

            emit Claim(producerToken, user);

            // Transfer the proportionate reward token amounts to the recipient
            for (uint256 i; i < rLen; ++i) {
                ERC20 rewardToken = rewardTokens[i];
                address rewardRecipient = p.rewardRecipients[user][rewardToken];
                address recipient = rewardRecipient != address(0)
                    ? rewardRecipient
                    : user;
                uint256 rewardState = p.rewardStates[rewardToken];
                uint256 amount = (rewardState * userRewards) / globalRewards;

                if (amount != 0) {
                    // Update reward state (i.e. amount) to reflect reward tokens