Submitted by crypticdefense, also found by Agontuk and mrMorningstar
AuraVault::claim allows users to claim rewards corresponding to the amount of WETH they are depositing in the same call.
Prior to sending rewards to msg.sender, a percentage of the rewards is sent to the vault locker rewards. However, the percentage of the rewards sent to the vault locker rewards is not deducted from the amount that is sent to the caller. The entire reward amount is sent to msg.sender.
This is problematic, as it creates two possible scenarios:
Therefore, the impact ranges from stolen funds to Denial of Service.
As users interact with the AuraVault contract, the contract will accumulate rewards through interaction with an external rewards contract, which acts as an ERC-4626 vault.
Users can deposit, withdraw, redeem, and claim rewards:
AuraVault.sol#L275-L310
Firstly, rewards are claimed from the Aura reward pool, proceeded by a call to _previewReward() to calculate the amount of WETH the caller must deposit to receive the amount of rewards they have specified.
The issue is with the transferring of rewards. We can see the vault locker rewards receives a percentage of the rewards, calculated by (amounts[0] * _config.lockerIncentive) / INCENTIVE_BASIS).
However, the entire amount of rewards is still sent to the caller, without accounting for the percentage that was just sent to the vault locker rewards. Therefore, this call is sending extra rewards to the caller.
As mentioned, this leads to two scenarios:
Consider the following scenario:
The call will revert in the case described above, and Alice would have to specify a lower amount of rewards (i.e., 50e18 BAL and AURA), but we can see that the contract will still send more rewards than intended, effectively stealing rewards from others.
Foundry
Ensure the amount sent to the locker is deducted from the amount sent to the caller:
Error
amarcu (LoopFi) acknowledged and commented via duplicate issue #206:
