Submitted by 0xComfyCat
https://github.com/code-423n4/2023-07-amphora/blob/main/core/solidity/contracts/core/VaultController.sol#L376-L412
https://github.com/code-423n4/2023-07-amphora/blob/main/core/solidity/contracts/core/Vault.sol#L93-L105
https://github.com/code-423n4/2023-07-amphora/blob/main/core/solidity/contracts/core/Vault.sol#L111-L133
https://github.com/code-423n4/2023-07-amphora/blob/main/core/solidity/contracts/core/VaultController.sol#L676-L679
When Convex pool of an asset that has CurveLPStakedOnConvex collateral type is shut down, users can no longer deposit that asset into vault since it would always revert on Convex booster deposit function, called during vaults depositERC20 process. With lack of method to update it, protocol would the ability to accept it as collateral even as plain LP without staking. Also users that use the asset as collateral may face risk of being liquidated.
This is also applicable when Convex itself shutdown their booster contract.
Based on projects e2e test, extending CommonE2EBase contract. The test showed that depositERC20 is bricked when Convex pool is shut down.
Foundry
The fix requires 2 modifications
Failed liquidation if state is not reflected correctly
The fix
0xShaito (Amphora) disagreed with severity and commented:
LSDan (judge) decreased severity to Medium and commented:
0xShaito (Amphora) confirmed
For this audit, 51 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by DavidGiladi received the top score from the judge.
The following wardens also submitted reports: 0xSmartContract, Bauchibred, Musaka, hunter_w3b, kutugu, alymurtazamemon, Rolezn, Qeew, halden, MohammedRizwan, naman1778, Kaysoft, qpzm, Limbooo, sakshamguruji, Arabadzhiev, SanketKogekar, Deekshith99, No12Samurai, Eeyore, Topmark, ljmanini, mojito_auditor, ro1sharkm, josephdara, SM3_SS, bigtone, erebus, mrpathfindr, giovannidisiena, Hama, 0xmuxyz, jeffy, deth, sivanesh_808, SAAJ, PNS, Brenzee, grearlake, T1MOH, Walter, btk, 8olidity, 0xComfyCat, adeolu, nnez, uzay, debo, VIELITE, and 0xWaitress.
