Incentive fund loss when calling claim() in AutoPxGlp/PxGmxRewards because it calls this.compound(,,true) which would transfer incentive to contract itself and those funds won't be calculated as rewards or fee and won't be accessible to withdraw

Lines of code Vulnerability details Impact Function claim in PxGmxReward contract is used for claiming available pxGMX rewards of a user. but this function calls IAutoPxGlpaddressthis.compound1, 1, true; to harvest new rewards and stake them to compound rewards. but this call is external call and...

´userAccrue` rewards manipulation

Lines of code Vulnerability details Impact A flashloan can be used to set a huge last balance which later will accrue a huge reward. Proof of Concept Buy lots of a rewards-producing token, possibly by means of a flashloan. Call PirexRewards.userAccrue which sets u.lastBalance to this now very hig...