The burn function is used to extract the token of the user despoit, and transfer the reward CRV to the user. Lines 156 and 157 are CrvPerShare of user mint and now. The problem here is that gauge.lp_token().decimals() should be used instead of 1e18.
Assuming that the decimals of LP Token is 8, the rewards received by users will be reduced by 1e10 times. Conversely, if the decimals of LP Token is 20, then the user's reward will increase by 100 times.
Impact
There may be two situations, depending on the decimals of LP Token:
All users are rewarded less than expected, excess rewards will be trapped in the contract
A small number of people have obtained excess rewards, and because the CRV is not enough, the contract is permanently DOS, and the rest cannot withdraw their own funds
J4de
medium
WCurveGauge.sol#burn
function should use LP Token's decimals instead of1e18
Summary
WCurveGauge.sol#_mintCrv
should use LP Token's decimals instead of1e18
Vulnerability Detail
The
burn
function is used to extract the token of the user despoit, and transfer the reward CRV to the user. Lines 156 and 157 are CrvPerShare of user mint and now. The problem here is thatgauge.lp_token().decimals()
should be used instead of1e18
.Assuming that the decimals of LP Token is 8, the rewards received by users will be reduced by 1e10 times. Conversely, if the decimals of LP Token is 20, then the user's reward will increase by 100 times.
Impact
There may be two situations, depending on the decimals of LP Token:
Code Snippet
https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/wrapper/WCurveGauge.sol#L156-L157
Tool used
Manual Review
Recommendation