Closed sherlock-admin closed 1 year ago
Escalate for 10 USDC
The Curve docs are clear
The weight systems allow the Curve DAO to dictate where the CRV inflation should go…
there is no guarantee that the gauges will receive CRV because the weight system is controlled by the Curve DAO so at any time, the weight (CRV) of any gauge could down to zero
Escalate for 10 USDC
The Curve docs are clear
The weight systems allow the Curve DAO to dictate where the CRV inflation should go…
there is no guarantee that the gauges will receive CRV because the weight system is controlled by the Curve DAO so at any time, the weight (CRV) of any gauge could down to zero
You've created a valid escalation for 10 USDC!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Can be a valid medium
Escalation rejected
Valid low
Although there is a possible edge case mentioned where it could happen, these gauges are whitelisted by the admin.
This would affect only those users who would deposit after the gauge was disabled. the admin can always disable deposits by setting maxPosSize
to zero.
Given all these factors considering this issue a valid low.
Escalation rejected
Valid low Although there is a possible edge case mentioned where it could happen, these gauges are whitelisted by the admin. This would affect only those users who would deposit after the gauge was disabled. the admin can always disable deposits by setting
maxPosSize
to zero. Given all these factors considering this issue a valid low.
This issue's escalations have been rejected!
Watsons who escalated this issue will have their escalation amount deducted from their next payout.
Ch_301
high
CurveSpell.closePositionFarm()
will keep revertingSummary
Curve has a weight system for the Gauges https://resources.curve.fi/reward-gauges/understanding-gauges#the-dao
So there is no guarantee that a specific Gauge will always receive CRV (rewards)
Vulnerability Detail
In case the user invokes
closePositionFarm()
after this lineon
CurveSpell.closePositionFarm()
the SPELL will receive no rewards (no CRV) And afterCurveSpell.closePositionFarm.[_doCutRewardsFee()](https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/CurveSpell.sol#L165)
the value of
rewards
is zerorewards == 0
So swapExactTokensForTokens will execte withamountIn == 0
And this call will revert in this line
Impact
CurveSpell.closePositionFarm()
will keep reverting which could lead the position to the liquidationCode Snippet
Tool used
Manual Review
Recommendation