Open hats-bug-reporter[bot] opened 7 months ago
Hi, this issue has a similar root cause of issue #7 that I have submitted before, but it's in a different contract, So it's up to you if you want to merge it with #7 or consider it as a separate issue,
combined with #7
Github username: -- Twitter username: -- Submission hash (on-chain): 0xd932d4999df7e0fe1e50b62447d2343df0fd6d557c2c4396bd4819c1d173a26a Severity: medium
Description:
Description
FeeManager.claimWiseFees
function can be called by anyone to claim all entitled fees from theWiseLending
contract and send them to theFeeManager
contract, where these fee tokens are aquired in form of shares from each pool.In
FeeManager.claimWiseFees
function:FEE_MANAGER_NFT
of a specified pool.WiseLending
contract.poolToken
is checked if it's an aave token (aToken
); and if it's the case; the underlying asset of thatpoolToken
is withdrawn from aave pool viaAAVE.withdraw
and asigned to thetokenAmount
:tokenAmount
is distributed as incentives for incentive owners (A & B).tokenAmount
:Impact
How could this result in a stuck
feeTokens
in theFeeManager
contract?feeToken
is an aave lp token, the underlying is going to be withdrawn from aave (refer to point#3 above) andtokenAmount
will be set to that withdrawn value, butAAVE.withdraw
function returns the actual amount of the underlying asset that's returned from the operation, where it might in some cases be less than the actual required amount:aave.IPool.withdraw
feeToken
(aave lp token) in theFeeManager
contract; since entitled users to receive incentives (beneficials when there's no bad debt, and as incentives for repayers of bad debts) will be only able to withdraw a limit offeeTokens[_feeToken]
amount only.Code Instance
FeeManager.claimWiseFees function
Tool used
Manual Review.
Recommendation
In
FeeManager.claimWiseFees
function, re-deposit any residual aave lp token that haven't been burnt (still stuck in the contract when withdrawing viaAAVE.withdraw
) inWiseLending
on behalf ofFEE_MANAGER_NFT
.