Submitted by GalloDaSballo
compoundAmount will always try to sell 0 tokens because the staticall will revert since the function changes storage in checkpoint
This causes the compoundAmount to always return 0, which means that the Strategy is underpriced at all times allowing to Steal all Rewards via:
This Test is done on the Arbitrum Tricrypto Gauge with Foundry
1 is the flag value for a revert
0 is the expected value
We get 1 when we use staticcall since the call reverts internally
We get 0 when we use call since the call doesnt
The comment in the Gauge Code is meant for usage off-chain, onChain you must accrue (or you could use a Accrue Then Revert Pattern, similar to UniV3 Quoter)
NOTE: The code for Mainnet is the same, so it will result in the same impact https://etherscan.io/address/0xDeFd8FdD20e0f34115C7018CCfb655796F6B2168#code#L375
Which will revert since checkpoint is a non-view function and staticall reverts if any state is changed
https://arbiscan.io/address/0x555766f3da968ecbefa690ffd49a2ac02f47aa5f#code#L168
You should use a non-view function like incompound
cryptotechmaker (Tapioca) confirmed
