Submitted by Ack, also found by kaden and rvierdiiev
The AaveStrategy contract is designed to:
There are several issues with this flow, but this vulnerability report is specific to redeeming staked rewards. The incentives controller specified in the mainnet.env file is at address 0xd784927Ff2f95ba542BfC824c8a8a98F3495f6b5 (proxy). Its claimRewards function stakes tokens directly:
The only way to retrieve tokens once staked is via a call to stakingRewardToken#redeem(), which is not present in the AaveStrategy contract. As a result, any rewards accumulated via the incentiveController would not be claimable.
High - Loss of funds
This is unfortunately difficult to PoC as the AAVE incentive/staking rewards do not accumulate properly in the fork tests, and the mocks do not exhibit the same behavior.
Include a call to redeem in compound().
0xRektora (Tapioca) confirmed via duplicate issue 243
