LiquidityMining.claimConcentratedRewards() does not properly account user liquidity across ticks

Lines of code Vulnerability details Let’s say a user creates two separate positions, one is tick-15, tick and the second is tick, tick+15. The user is covering the entirety of the tick range to receive rewards but does not receive any. We see that posKey is defined like this: bytes32 posKey =...

Imbalance and LP gain is forever stuck in USDMPegRecovery

Lines of code Vulnerability details Impact After depositing into Curve, underlying USDM and pool3 of each LP share will change due to 1. Swap fee 2. Pool imbalance However, userLiquidity does not update according to current underlying LP balance. When guardian remove liquidity from Curve, at leas...