Submitted by cccz
Same as https://github.com/code-423n4/2022-02-concur-findings/issues/244
All calculations are rounded down, since a lack of tokens in the contracts cannot be rounding errors fault. So the function is redundant.
On the other hand, if the contract is undersupplied with cvx tokens, this will cause depositors to be sent less tokens than needed (or none). This is especially unsafe because the tokens that were lacking are not resembled in accountings at all. Thus a depositor may invoke the safeRewardTransfer and not receive tokens they were supposed to.
ConvexMasterChef.sol#L299-L306
Use usual safeTransfer instead of safeRewardTransfer.
0xMaharishi (Aura Finance) acknowledged, but disagreed with severity and commented:
LSDan (judge) commented:
0xMaharishi (Aura Finance) resolved:
