Unbounded iteration over bonusTokens array
If the bonusTokens array grows big enough, the gas cost to execute distributeBonusTokenRewards could be higher than the block limit and the withdraw function is forever disabled.
Recommended Mitigation
Keep bonusTokens small by adding a hard limit or add a function to remove bonusTokens.
Judge has assessed an item in Issue #207 as Medium risk. The relevant finding follows: