BlastOnboarding's claimTokenYields, LockingMultiRewards _updateRewardsForUsers, Router _swap vulnerabilities may lead to gas exhaustion and DoS.
Audit: 2024-03-abracadabra-money-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/blast/BlastOnboarding.sol#L164-L173
https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/staking/LockingMultiRewards.sol#L572-L593
https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/mimswap/periphery/Router.sol#L541-L558


# Vulnerability details

1. BlastOnboarding - `claimTokenYields` function:

`claimTokenYields` function in the BlastOnboarding contract accepts an array of token addresses as input and iterates over them to claim token yields. The loop length is determined by the size of the input array, which could potentially be large. This can lead to excessive gas consumption and potential DoS (Denial of Service) attacks.

## Impact
An attacker can pass a large array of token addresses to the `claimTokenYields` function, causing the loop to iterate over a significant number of tokens. This can result in the transaction exceeding the gas limit and failing, effectively preventing other users from interacting with the contract and claiming their token yields.

Let's consider a scenario where an attacker creates an array of 1000 token addresses and calls the `claimTokenYields` function with this array. The function will iterate over all 1000 tokens, claiming yields for each one. This can lead to a significant increase in gas consumption, potentially exceeding the gas limit and causing the transaction to fail. As a result, other users may be unable to claim their token yields until the gas limit is increased or the attack subsides.

Code: [claimTokenYields](https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/blast/BlastOnboarding.sol#L164-L173)
```solidity
function claimTokenYields(address[] memory tokens) external onlyOwner {
    for (uint256 i = 0; i < tokens.length; i++) {
        if (!supportedTokens[tokens[i]]) {
            revert ErrUnsupportedToken();
        }
        if (registry.nativeYieldTokens(tokens[i])) {
            BlastYields.claimAllTokenYields(tokens[i], feeTo);
        }
    }
}
```

## Recommendation
Consider implementing a reasonable limit on the number of token addresses that can be passed to the `claimTokenYields` function. This can be done by adding a check on the length of the input array and reverting if it exceeds a predefined threshold.

2. LockingMultiRewards - `_updateRewardsForUsers` function:

`_updateRewardsForUsers` function in the LockingMultiRewards contract has nested loops: an outer loop over reward tokens and an inner loop over user addresses. The loop lengths are determined by the number of reward tokens and the size of the input array of user addresses, respectively. This can lead to excessive gas consumption and potential DoS attacks.

## Impact
An attacker can manipulate the input array of user addresses passed to the `_