Submitted by WatchPug, also found by bobi, CertoraInc, csanuragjain, danb, hickuphh3, and leastwood
ConvexStakingWrapper.sol#L246
StakingRewards.sol#L99
MasterChef.sol#L159-L167
ConvexStakingWrapper, StakingRewards is using masterChef.deposit(), masterChef.withdraw(), and these two functions on masterChef will take _msgSender() as the user address, which is actually the address of ConvexStakingWrapper and StakingRewards.
As a result, when calling ConvexStakingWrapper.deposit(), ConvexStakingWrapper.withdraw(), StakingRewards.stake(), StakingRewards.withdraw(), the concur rewards belongs to all the users of ConvexStakingWrapper / StakingRewards will be sent to the caller wrongfully.
Actual results on masterChef:
Expected results:
Actual results on masterChef:
Expected results:
Consider adding two new functions to MasterChef: depositFor() and withdrawFor().
ConvexStakingWrapper, StakingRewards can utilize these two functions and get the accounting right.
ryuheimat (Concur) confirmed
