Submitted by rscodes, also found by pkqs90
In ChefIncentivesController.sol:
The function calls isEligibleForRewards without calling refresh; hence, things like disqualification resulting from a change in price will not be accounted for. This transaction will go through without reverting, allowing the user to claim even though his total value locked is now below 5% of his debt due to the price change of the token.
The checkAndProcessEligibility(_user, true, true); function, however, does include refresh, which will update the users status. Hence, that line should be called first, so that the transaction will revert in the if statement, to prevent malicious lockers from calling this function even when they are not eligible.
Invalid Validation
amarcu (LoopFi) confirmed and commented:
Koolex (judge) decreased severity to Medium and commented:
