Submitted by hyh
Now there are no checks for the amounts to be transferred via _transferYield and _processTreasury. As reward token list is external and an arbitrary token can end up there, in the case when such token doesnt allow for zero amount transfers, the reward retrieval can become unavailable.
I.e. processYield() can be fully blocked for even an extended period, with some low probability, which cannot be controlled otherwise as pool reward token list is external.
Setting the severity to medium as reward gathering is a base functionality for the system and its availability is affected.
_transferYield proceeds with sending the amounts to treasury and yieldManager without checking:
ConvexCurveLPVault.sol#L74-L82
ConvexCurveLPVault.sol#L205-L209
The incentive token can be arbitrary. Some ERC20 do not allow zero amounts to be sent:
https://github.com/d-xo/weird-erc20#revert-on-zero-value-transfers
In a situation of such a token added to reward list and zero incentive amount earned the whole processYield call will revert, making reward gathering unavailable until either such token be removed from pools reward token list or some non-zero reward amount be earned. Both are external processes and arent controllable.
Consider running the transfers in _transferYield only when yieldAmount is positive:
sforman2000 (Sturdy) confirmed
atozICT20 (Sturdy) commented:
hickuphh3 (judge) commented:
