StrategyPassiveManagerVelodrome.harvest will revert after calling StrategyPassiveManagerVelodrome.setRewardPool
Summary
After calling StrategyPassiveManagerVelodrome.setRewardPool, the StrategyPassiveManagerVelodrome doesn't set allowance for rewardPool. Whthout the allowance, IRewardPool(rewardPool).notifyRewardAmount will revert.
Vulnerability Detail
After calling StrategyPassiveManagerVelodrome.setRewardPool, the allowance doesn't clear for the old rewardPool, and more important, the function doesn't set allowance for new rewardPool.
function notifyRewardAmount(
address _reward,
uint256 _amount,
uint256 _duration
) external onlyManager update(address(0)) {
...
IERC20Upgradeable(_reward).safeTransferFrom(msg.sender, address(this), _amount); <<<--- function will revert because of lacking of allowance
...
}
Impact
StrategyPassiveManagerVelodrome.harvest will revert.
jasonxiale
medium
StrategyPassiveManagerVelodrome.harvest
will revert after callingStrategyPassiveManagerVelodrome.setRewardPool
Summary
After calling
StrategyPassiveManagerVelodrome.setRewardPool
, theStrategyPassiveManagerVelodrome
doesn't set allowance forrewardPool
. Whthout the allowance,IRewardPool(rewardPool).notifyRewardAmount
will revert.Vulnerability Detail
After calling StrategyPassiveManagerVelodrome.setRewardPool, the allowance doesn't clear for the old rewardPool, and more important, the function doesn't set allowance for new
rewardPool
.Without the allowance, IRewardPool(rewardPool).notifyRewardAmount will revert because accordining to rewardPool in test
Impact
StrategyPassiveManagerVelodrome.harvest
will revert.Code Snippet
https://github.com/sherlock-audit/2024-05-beefy-cowcentrated-liquidity-manager/blob/42ef5f0eac1bc954e888cf5bfb85cbf24c08ec76/cowcentrated-contracts/contracts/strategies/velodrome/StrategyPassiveManagerVelodrome.sol#L776-L779
Tool used
Manual Review
Recommendation
Duplicate of #3