030.md

Late Flaxen Sparrow

Medium

Changing reward vault without claiming rewards is a loss for previous vault

Summary

The SolidlyV2AMO implementation allows the collecting and transfer of reward tokens from the Solidly gauge to a designated reward vault. Changing the reward vault without first claiming existing reward tokens will be a loss for the old vault.

Root Cause

In case it’s a mistake in the code: In {link to code} the {root cause}

In the SolidlyV2AMO contract, retrieving rewards from the Solidly gauge is done by calling the getReward function. getReward transfers the rewards to the rewardVault address at that time.

The rewardVault address can be changed via the setVault function. However, calling the setVault function does not distributes existing, pending rewards up to this point to the already existing vault

function setVault(address rewardVault_) public override onlyRole(SETTER_ROLE) {
    if (rewardVault_ == address(0)) revert ZeroAddress();
    rewardVault = rewardVault_;
    emit VaultSet(rewardVault);
}

Internal pre-conditions

SETTER_ROLE calls the SolidlyV2AMO::setVault function before the REWARD_COLLECTOR_ROLE calls SolidlyV2AMO::getReward when there are pending rewards in the gauge.

External pre-conditions

Pending rewards need to exist in the Solidly Gauge contract that are associated with the SolidlyV2AMO contract.

Attack Path

As the preconditions.

Impact

Previous reward vault loses any pending rewards. This is a loss of funds.

PoC

No response

Mitigation

Modify the setVault to also call getReward before-hand.