`GovNFT` contract's owner can stop Governance NFT holders from receiving more rewards from trades' DAO fees, and such reward amounts can remain in `Trading` contract without belonging to anyone
Audit: 2022-12-tigris-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/GovNFT.sol#L307-L309
https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/GovNFT.sol#L287-L294


# Vulnerability details

## Impact
According to https://docs.tigris.trade/protocol/governance, "Profits from trading fees are paid out to [Governance] NFT holders in real-time...Rewards are paid out in Tigris stablecoins." However, for some legitimate reasons, such as if the corresponding Tigris stablecoin has a bug, or if the owner of the `GovNFT` contract becomes compromised or malicious, this owner can call the following `GovNFT.setAllowedAsset` function to stop the corresponding Tigris stablecoin from being used as a reward token. After this happens, when calling functions like `Trading._handleOpenFees` and `Trading._handleCloseFees`, the `GovNFT.distribute` function below that is further called would not transfer the trade's DAO fee amount of the corresponding Tigris stablecoin from the `Trading` contract to the `GovNFT` contract. Instead, such amount can remain in the `Trading` contract without belonging to anyone when functions like `Trading.initiateCloseOrder` are called. As a result, the Governance NFT holders cannot receive more deserved rewards from the DAO fees generated by the trades as long as the corresponding Tigris stablecoin is not allowed for being used as a reward token, which can be permanent if such Tigris stablecoin can no longer be used due to a bug or the `GovNFT` contract's owner is compromised or malicious.

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/GovNFT.sol#L307-L309
```solidity
    function setAllowedAsset(address _asset, bool _bool) external onlyOwner {
        _allowedAsset[_asset] = _bool;
    }
```

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/GovNFT.sol#L287-L294
```solidity
    function distribute(address _tigAsset, uint _amount) external {
        if (assets.length == 0 || assets[assetsIndex[_tigAsset]] == address(0) || totalSupply() == 0 || !_allowedAsset[_tigAsset]) return;
        try IERC20(_tigAsset).transferFrom(_msgSender(), address(this), _amount) {
            accRewardsPerNFT[_tigAsset] += _amount/totalSupply();
        } catch {
            return;
        }
    }
```

## Proof of Concept
Please add the following test in the `Trading using <18 decimal token` `describe` block in `test\07.Trading.js`. This test will pass to demonstrate the described scenario. Please see the comments in this test for more details.

```typescript
    it.only(`GovNFT contract's owner can stop Governance NFT holders from receiving more rewards from trades' DAO fees,
             and such reward amounts can remain in Trading contract without belonging to anyone`, async function () {
      let TradeInfo = [parseEther("1000"), MockUSDC.address, StableVault.address, parseEther("5"), 0, true, parseEther("0"), parseEther("0"), ethers.constants.HashZero];
      let openPriceData = [node.address, 0,