_sendForReceiver is vulnerable to reentrancy. This enables a receiver to drain the remaining fees to distribute.

An attacker can cause an overflow in the flashLoan function

A malicious receiver can cause another receiver to lose out on distributed fees by returning `false` for `tokensReceived` when receiveRewards is called on their receiver contract.

The direct redeem fee can be circumvented