Closed sherlock-admin closed 1 year ago
@weitianjie2000
This seems like a good safe guard, however, it's not clear to me that reward tokens actually can be duplicated on Liquidity Gauges. Also, adding a de-duplication check would add a decent amount of additional code to reduce a risk that has limited impact and is not clear actually exists.
I would decrease this to low severity since the fee transfer is proportional and also goes to a Notional protocol controlled address.
csanuragjain
medium
Duplicate reward can lead to deduction of extra fees than required
Summary
In AuraStakingMixin contract, if _rewardTokens contains duplicate token then fees will be deducted twice instead of deducting it once.
Vulnerability Detail
Impact
More fees than required will be deducted reducing the claimable balance
Code Snippet
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/mixins/AuraStakingMixin.sol#L47
Tool used
Manual Review
Recommendation
Revise the _rewardTokens method to remove all duplicate tokens