Closed code423n4 closed 2 years ago
The wrapper is used to wrap convex token which are wrapped curve LP tokens. As a reward only CRV
or CVX
tokens are rewarded. Apart from there would be other tokens but never convex wrapped curve LP tokens. So, based on this assumption the above attack is not possible.
Per the sponsor reply, the finding is invalid
Handle
WatchPug
Vulnerability details
Given that
ConvexYieldWrapper.sol#wrap()
allows anyone towrap
with the contract's balance ofconvexToken
to an arbitrary address.https://github.com/code-423n4/2022-01-yield/blob/e946f40239b33812e54fafc700eb2298df1a2579/contracts/ConvexYieldWrapper.sol#L125-L135
If one of the
extraRewards
provided by Convex's Staking program is rewarded with Convex Token, then the attacker will be able to steal the Convex Token rewards simply by callingConvexYieldWrapper.sol#wrap()
.Considering that providing staking rewards with the platform's house token is rather common and popular, we believe it should be taken into consideration.
Recommendation
Consdier changing to: