Upgraded Q -> 2 from #70 [1696570151963]

[c4-judge]

Judge has assessed an item in Issue #70 as 2 risk. The relevant finding follows:

[L-05] Users who hold vAfEth instead of afETh might lose out on rewards unfairly In the applyRewards() function, the ETH gained by selling rewards from Votium is deposited into depositRewards() of the AfEth contract:

VotiumStrategyCore.sol#L302-L304

    if (address(manager) != address(0))
        IAfEth(manager).depositRewards{value: ethReceived}(ethReceived);
    else depositRewards(ethReceived);

depositRewards() in the AfEth contract determines deposits the ETH into either safEth or back into the VotiumStrategy contract based on the current safEthRatio:

AfEth.sol#L286-L292

    uint256 totalTvl = (safEthTvl + votiumTvl);
    uint256 safEthRatio = (safEthTvl * 1e18) / totalTvl;
    if (safEthRatio < ratio) {
        ISafEth(SAF_ETH_ADDRESS).stake{value: amount}(0);
    } else {
        votiumStrategy.depositRewards{value: amount}(amount);
    }

However, if the ETH gained from rewards are deposited into safEth, users that are holding vAfEth will not accrue any rewards. This is because vAfEth's TVL is only affected by the protocol's amount of CVX, and not the protocol's safEth amount, which means that the price of vAfEth will not change if rewards are deposited into safEth.

Therefore, if applyRewards() deposits rewards into safEth, only afEth holders will accrue rewards, leading to an unfair loss of yield for users that hold vAfEth.

Note that it is possible for users to hold vAfEth by calling the deposit() function of the VotiumStrategy contract directly, instead of depositing into the AfEth contract.

Recommendation In applyRewards(), consider depositing rewards to only the VotiumStrategy contract:

VotiumStrategyCore.sol#L302-L304

• if (address(manager) != address(0))
• IAfEth(manager).depositRewards{value: ethReceived}(ethReceived);
• else depositRewards(ethReceived);
• depositReward(ethReceived);

[c4-judge]

0xleastwood marked the issue as satisfactory

[c4-judge]

0xleastwood marked the issue as duplicate of #33

[c4-judge]

This auto-generated issue was withdrawn by 0xleastwood

[c4-judge]

This previously downgraded issue has been upgraded by 0xleastwood

[c4-judge]

0xleastwood marked the issue as unsatisfactory: Invalid

[c4-judge]

This auto-generated issue was withdrawn by 0xleastwood

[c4-judge]

This previously downgraded issue has been upgraded by 0xleastwood

[c4-judge]

This auto-generated issue was withdrawn by 0xleastwood

[c4-judge]

This previously downgraded issue has been upgraded by 0xleastwood

[c4-judge]

This auto-generated issue was withdrawn by 0xleastwood