hats-finance / Convergence---Convex-integration-0xb3df23e155b74ad2b93777f58980d6727e8b40bb

0 stars 1 forks source link

Some functions might revert due to zero value transfer tokens #29

Open hats-bug-reporter[bot] opened 6 months ago

hats-bug-reporter[bot] commented 6 months ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xff825c41871f4f96e309f3eaca3d3dc61981c2c067451593b2fb0858382e2a0a Severity: low

Description: Description\

Both CvxConvergenceLocker.sendTokens() and CVX1.recoverRewards() are used to recover the sent the tokens to contracts. They are either sent to recipient address or treasuryPod in case of CVX1.recoverRewards(), Basically, the functions are introduced so that any token except rewards tokens could be recovered. These functions restricts the reward tokens from being transferred to recipient address.

There are some tokens which reverts on transferring a zero value amount. LEND is such a token. When the tokens is being recovered the function has used array so in single transaction all such tokens can be recovered and send back to recipient addresses, however with zero value token transfer issue, the transaction will revert if such token is a part of transaction.

Inline with the recommendation on #4, consider below additional changes to prevent the function revert due to this issue.

Recommendation to fix\ Consider checking the amount being transferred is greater than zero in both CvxConvergenceLocker.sendTokens() and CVX1.recoverRewards().

For example:

if (amount > 0)
    token.safeTransfer(account, amount);
0xRizwan commented 5 months ago

@0xR3vert Can you please provide invalid reason here?