Lines of code

Vulnerability details

The ConvexStakingWrapper contract uses several reward pool tokens rewards[_pid][_index].token and it can be that the same token is used for different _pids.
Indeed, the CVX/CRV tokens are always at index 0 and 1.

The rewards will be distributed to the first pool id (_pid) calling checkpoint() -> _calcRewardIntegral().
The other pools don’t receive any rewards.

function _calcRewardIntegral(
    uint256 _pid,
    uint256 _index,
    address _account,
    uint256 _balance,
    uint256 _supply
) internal {
    RewardType memory reward = rewards[_pid][_index];

    // @audit first pid to call this receives the current reward token balance
    uint256 bal = IERC20(reward.token).balanceOf(address(this));
    // ...

    uint256 d_reward = bal - reward.remaining;
    IERC20(reward.token).transfer(address(claimContract), d_reward);

    // ...
}

Recommended Mitigation Steps

If several pools use the same reward token, it should be distributed fairly among these pools, similar to the allocation points in a MasterChef contract.

The text was updated successfully, but these errors were encountered:

All reactions