hansfriese - `AuraStakingMixin.claimRewardTokens()` might revert for some edge cases.

[sherlock-admin]

hansfriese

medium

AuraStakingMixin.claimRewardTokens() might revert for some edge cases.

Summary

AuraStakingMixin.claimRewardTokens() might revert for some edge cases.

Vulnerability Detail

AuraStakingMixin.claimRewardTokens() might revert for some edge cases.

Currently, it transfers the feeAmount to FEE_RECEIVER for each rewardToken here.

AURA_REWARD_POOL.getReward(address(this), true);
for (uint256 i; i < numRewardTokens; i++) {
    claimedBalances[i] = rewardTokens[i].balanceOf(address(this)) - claimedBalances[i];

    if (claimedBalances[i] > 0 && feePercentage != 0 && FEE_RECEIVER != address(0)) {
        uint256 feeAmount = claimedBalances[i] * feePercentage / BalancerConstants.VAULT_PERCENT_BASIS;
        rewardTokens[i].checkTransfer(FEE_RECEIVER, feeAmount); //@audit-transfer0
        claimedBalances[i] -= feeAmount;
    }
}

Btw such transfers might revert for some reason.

• First, it doesn't check if feeAmount != 0 before transferring the fee.
• Even if claimedBalances[i] > 0 && feePercentage != 0, it's possible feeAmount == 0 with the low balance and feePercentage, and some tokens don't allow 0-transfer as we can see here.
• The above case will be likely to happen when the token has low decimals.
• Second, the FEE_RECEIVER might be blacklisted and the transfer failed as explained here.

Impact

claimRewardTokens() might revert for some reason during fee transfer.

Code Snippet

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/mixins/AuraStakingMixin.sol#L78

Tool used

Manual Review

Recommendation

• For the first issue, we can check once more if feeAmount > 0 before the transfer here.
• For the second issue, we can record the fee amount for each token using the mapping and transfer later independently.