Secure rewards function

[juliangruber]

I'm closing this for now, as we have a new issue for addressing all concerns from the audit