Submitted by leastwood
The shelter mechanism provides emergency functionality in an effort to protect users funds. The enterShelter function will withdraw all LP tokens from the pool, transfer them to the shelter contract and activate the shelter for the target LP token. If this function is called again on the same LP token, the amountInShelter value is overwritten, potentially by the zero amount. As a result  its possible that the shelter is put in a state where no users can withdraw from it or only a select few users with a finite number of shares are able to. Once the shelter has passed its grace period, these tokens may forever be locked in the shelter contract.
ConvexStakingWrapper.sol#L107-L119
ConvexStakingWrapper.sol#L132-L135
Consider adding to the amountInShelter[lpToken] mapping instead of overwriting it altogether. This will allow enterShelter to be called multiple times with no loss of funds for the protocols users.
ryuheimat (Concur) confirmed
Alex the Entreprenerd (judge) commented:
