search

code-423n4 / 2022-01-yield-findings

1 stars 0 forks source link

Cvx3CrvOracle earned function calculates cvx wrongly if pool claimed indirectly #95

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

kenzo

Vulnerability details

The ConvexStakingWrapper that Yield is based on recently published a fix for earned function in case the pool is claimed indirectly.

Impact

Wrong results might be returned from view function earned.

Proof of Concept

This is the fix for earned: fix commit

Recommended Mitigation Steps

Apply fix.

GalloDaSballo commented 2 years ago

Very much appreciated finding that notifies the sponsor of some recent CVX updates. Because there's no POC, I believe low severity to be appropriate