Extra rewards for Aura are not coming from the gauge, but rather from the extraRewards field in the RewardPool
Because of this, any additional reward token added via the Aura system will not be tracked, won't be claimed and will remain stuck in the BaseRewardPool
Impact
Loss of Yield for Additional tokens, Protocol X decides to Airdrop / Do liquidity mining in their own token.
Those tokens won't be claimable as they will be added to BaseRewardPool4626 and not to the Gauge.
GalloDaSballo
medium
M-01 Loss of Reward Tokens for AuraStaking
Summary
AuraStakingMixin
assumes extra rewards come from the gauge.They will instead come from
BaseRewardPool
Vulnerability Detail
Extra rewards for Aura are not coming from the gauge, but rather from the
extraRewards
field in the RewardPoolBecause of this, any additional reward token added via the Aura system will not be tracked, won't be claimed and will remain stuck in the BaseRewardPool
Impact
Loss of Yield for Additional tokens, Protocol X decides to Airdrop / Do liquidity mining in their own token. Those tokens won't be claimable as they will be added to
BaseRewardPool4626
and not to the Gauge.Code Snippet
See Aura Code: https://github.com/aurafinance/convex-platform/blob/c570b332a074182d699015c598594e42d0f6b95b/contracts/contracts/BaseRewardPool.sol#L125
Tool used
Manual Review
Recommendation
Replace
With