Submitted by minhtrng
Vault.claimRewards assumes that CVX will always get minted to the Vault (if there is a CRV reward). If CVX does not get minted, the claim will fail, preventing payout of CRV and extra rewards. Looking at the Convex code there can be the case where the operator has changed, causing no mint to happen.
The function Vault.claimRewards calculates the CVX reward that is expected, which is then meant to be transferred to AMPHClaimer and the minter:
The Cvx contract which performs the mint contains the following logic:
The operator is the Booster contract which is called by BaseRewardPool which again is called by Vault.claimRewards. As can be seen in the snippet, the Convex protocol enables a shutdown case that wont break the BaseRewardPool, however the Vault implementation has not taken that case into consideration.
Severity deemed to be medium, due to high impact but special requirement.
Check the CVX balance of the vault before and after the claim to assert that the correct CVX amount has been minted.
0xShaito (Amphora) confirmed and commented:
