First, it doesn't check if feeAmount != 0 before transferring the fee.
Even if claimedBalances[i] > 0 && feePercentage != 0, it's possible feeAmount == 0 with the low balance and feePercentage, and some tokens don't allow 0-transfer as we can see here.
The above case will be likely to happen when the token has low decimals.
Second, the FEE_RECEIVER might be blacklisted and the transfer failed as explained here.
Impact
claimRewardTokens() might revert for some reason during fee transfer.
hansfriese
medium
AuraStakingMixin.claimRewardTokens()
might revert for some edge cases.Summary
AuraStakingMixin.claimRewardTokens()
might revert for some edge cases.Vulnerability Detail
AuraStakingMixin.claimRewardTokens()
might revert for some edge cases.Currently, it transfers the
feeAmount
toFEE_RECEIVER
for each rewardToken here.Btw such transfers might revert for some reason.
feeAmount != 0
before transferring the fee.claimedBalances[i] > 0 && feePercentage != 0
, it's possiblefeeAmount == 0
with the low balance andfeePercentage
, and some tokens don't allow 0-transfer as we can see here.FEE_RECEIVER
might be blacklisted and the transfer failed as explained here.Impact
claimRewardTokens()
might revert for some reason during fee transfer.Code Snippet
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/mixins/AuraStakingMixin.sol#L78
Tool used
Manual Review
Recommendation
feeAmount > 0
before the transfer here.