Submitted by said, also found by minhtrng
crvRewardsContract of convex can be called by anyone on behalf of Vault, this will allow malicious users to call getReward and break the Vault claimRewards functionality.
Convex rewarded allow anyone to call getReward on behalf of any users:
https://github.com/convex-eth/platform/blob/main/contracts/contracts/BaseRewardPool.sol#L263-L279
This will break Vault claimRewards functionality that depends on this getReward:
https://github.com/code-423n4/2023-07-amphora/blob/main/core/solidity/contracts/core/Vault.sol#L164-L229
This will allow malicious users to call getReward on behalf of Vaults, and basically prevent them to mint get the rewards and get the deserved AMPH tokens.
Create another functionality inside Vault that similar to claimRewards, but used CVX, CRV balance inside the contract, to perform the AMPH claim and claim the rewards.
0xShaito (Amphora) confirmed and commented:
