On-chain data is public, and an attacker can access the `userBalance` information and choose to attack users with higher balances; furthermore, the reward distribution mechanism can also lead to unfair phenomena.