Guard RewardLib fee ingress with balance deltas

[AztecBot]

Summary

RewardLib.handleRewardsAndFees credited checkpoint rewards and proof fees from the requested transfer amount before checking what the rollup actually received. This change keeps the existing standard-ERC20 assumption explicit by rejecting reward-distributor and fee-portal transfers whose balance delta does not exactly match the requested amount.

Fix

• Add an exact fee-asset balance-delta check around RewardDistributor.claim and FeeJuicePortal.distributeFees in RewardLib.
• Add burn-on-transfer regressions for both ingress paths so reward liabilities cannot be booked against short-funded FeeJuice.

Testing

• FOUNDRY_PROFILE=coverage forge test --match-path test/rollup/libraries/rewardlib/handleRewards.t.sol
• git diff --check

Issues

• Closes AztecProtocol/aztec-claude#585 — RewardLib credits FeeJuice rewards from requested transfers instead of received deltas.

---

Created by claudebox · group: l1-audit-remediation