0x52 - Pending CRV rewards are not accounted for and can cause unfair liquidations

[sherlock-admin]

0x52

high

Pending CRV rewards are not accounted for and can cause unfair liquidations

Summary

pendingRewards are factored into the health of a position so that the position collateral is fairly assessed. However WCurveGauge#pendingRewards doesn't return the proper reward tokens/amounts meaning that positions aren't valued correctly and users can be unfairly liquidated.

Vulnerability Detail

BlueBerryBank.sol#L408-L413

        (address[] memory tokens, uint256[] memory rewards) = IERC20Wrapper(
            pos.collToken
        ).pendingRewards(pos.collId, pos.collateralSize);
        for (uint256 i; i < tokens.length; i++) {
            rewardsValue += oracle.getTokenValue(tokens[i], rewards[i]);
        }

When BlueBerryBank is valuing a position it also values the pending rewards since they also have value.

WCurveGauge.sol#L106-L114

function pendingRewards(
    uint256 tokenId,
    uint256 amount
)
    public
    view
    override
    returns (address[] memory tokens, uint256[] memory rewards)
{}

Above we see that WCurveGauge#pendingRewards returns empty arrays when called. This means that pending rewards are not factored in correctly and users can be liquidated when even when they should be safe.

Impact

User is liquidated when they shouldn't be

Code Snippet

WCurveGauge.sol#L106-L114

Tool used

Manual Review

Recommendation

Change WCurveGauge#pendingRewards to correctly return the pending rewards

[Gornutz]

https://github.com/Blueberryfi/blueberry-core/commit/99fd7c37f73af2758ca42c2fb952a7975f6f9d01

[IAm0x52]

Linked PR does not address this issue. Though the WCurveGuage contract was not present in the second contest so it is presumably dropped. Waiting for sponsor comment.