Merge pull request #42 from Blueberryfi/sherlock-audit-fix-136

fix: pending cvx reward issue in WConvexPools
Blueberryfi · Jun 9, 2023 · 99fd7c3 · 99fd7c3
2 parents be76554 + 7f5cd94
commit 99fd7c3
Show file tree

Hide file tree

Showing 10 changed files with 441 additions and 114 deletions.
diff --git a/abi/IConvex.json b/abi/IConvex.json
@@ -0,0 +1,263 @@
+[
+  {
+    "anonymous": false,
+    "inputs": [
+      {
+        "indexed": true,
+        "internalType": "address",
+        "name": "owner",
+        "type": "address"
+      },
+      {
+        "indexed": true,
+        "internalType": "address",
+        "name": "spender",
+        "type": "address"
+      },
+      {
+        "indexed": false,
+        "internalType": "uint256",
+        "name": "value",
+        "type": "uint256"
+      }
+    ],
+    "name": "Approval",
+    "type": "event"
+  },
+  {
+    "anonymous": false,
+    "inputs": [
+      {
+        "indexed": true,
+        "internalType": "address",
+        "name": "from",
+        "type": "address"
+      },
+      {
+        "indexed": true,
+        "internalType": "address",
+        "name": "to",
+        "type": "address"
+      },
+      {
+        "indexed": false,
+        "internalType": "uint256",
+        "name": "value",
+        "type": "uint256"
+      }
+    ],
+    "name": "Transfer",
+    "type": "event"
+  },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "owner",
+        "type": "address"
+      },
+      {
+        "internalType": "address",
+        "name": "spender",
+        "type": "address"
+      }
+    ],
+    "name": "allowance",
+    "outputs": [
+      {
+        "internalType": "uint256",
+        "name": "",
+        "type": "uint256"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "spender",
+        "type": "address"
+      },
+      {
+        "internalType": "uint256",
+        "name": "amount",
+        "type": "uint256"
+      }
+    ],
+    "name": "approve",
+    "outputs": [
+      {
+        "internalType": "bool",
+        "name": "",
+        "type": "bool"
+      }
+    ],
+    "stateMutability": "nonpayable",
+    "type": "function"
+  },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "account",
+        "type": "address"
+      }
+    ],
+    "name": "balanceOf",
+    "outputs": [
+      {
+        "internalType": "uint256",
+        "name": "",
+        "type": "uint256"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "decimals",
+    "outputs": [
+      {
+        "internalType": "uint8",
+        "name": "",
+        "type": "uint8"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "maxSupply",
+    "outputs": [
+      {
+        "internalType": "uint256",
+        "name": "",
+        "type": "uint256"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "name",
+    "outputs": [
+      {
+        "internalType": "string",
+        "name": "",
+        "type": "string"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "reductionPerCliff",
+    "outputs": [
+      {
+        "internalType": "uint256",
+        "name": "",
+        "type": "uint256"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "symbol",
+    "outputs": [
+      {
+        "internalType": "string",
+        "name": "",
+        "type": "string"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "totalCliffs",
+    "outputs": [
+      {
+        "internalType": "uint256",
+        "name": "",
+        "type": "uint256"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [],
+    "name": "totalSupply",
+    "outputs": [
+      {
+        "internalType": "uint256",
+        "name": "",
+        "type": "uint256"
+      }
+    ],
+    "stateMutability": "view",
+    "type": "function"
+  },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "to",
+        "type": "address"
+      },
+      {
+        "internalType": "uint256",
+        "name": "amount",
+        "type": "uint256"
+      }
+    ],
+    "name": "transfer",
+    "outputs": [
+      {
+        "internalType": "bool",
+        "name": "",
+        "type": "bool"
+      }
+    ],
+    "stateMutability": "nonpayable",
+    "type": "function"
+  },
+  {
+    "inputs": [
+      {
+        "internalType": "address",
+        "name": "from",
+        "type": "address"
+      },
+      {
+        "internalType": "address",
+        "name": "to",
+        "type": "address"
+      },
+      {
+        "internalType": "uint256",
+        "name": "amount",
+        "type": "uint256"
+      }
+    ],
+    "name": "transferFrom",
+    "outputs": [
+      {
+        "internalType": "bool",
+        "name": "",
+        "type": "bool"
+      }
+    ],
+    "stateMutability": "nonpayable",
+    "type": "function"
+  }
+]
diff --git a/abi/IWConvexPools.json b/abi/IWConvexPools.json
@@ -122,7 +122,7 @@
     "name": "CVX",
     "outputs": [
       {
-        "internalType": "contract IERC20Upgradeable",
+        "internalType": "contract IConvex",
         "name": "",
         "type": "address"
       }

diff --git a/abi/WAuraPools.json b/abi/WAuraPools.json
@@ -745,19 +745,6 @@
     "stateMutability": "view",
     "type": "function"
   },
-  {
-    "inputs": [],
-    "name": "totalStaked",
-    "outputs": [
-      {
-        "internalType": "uint256",
-        "name": "",
-        "type": "uint256"
-      }
-    ],
-    "stateMutability": "view",
-    "type": "function"
-  },
   {
     "inputs": [
       {

diff --git a/abi/WConvexPools.json b/abi/WConvexPools.json
@@ -176,33 +176,14 @@
     "name": "CVX",
     "outputs": [
       {
-        "internalType": "contract IERC20Upgradeable",
+        "internalType": "contract IConvex",
         "name": "",
         "type": "address"
       }
     ],
     "stateMutability": "view",
     "type": "function"
   },
-  {
-    "inputs": [
-      {
-        "internalType": "uint256",
-        "name": "",
-        "type": "uint256"
-      }
-    ],
-    "name": "accCrvPerShares",
-    "outputs": [
-      {
-        "internalType": "uint256",
-        "name": "",
-        "type": "uint256"
-      }
-    ],
-    "stateMutability": "view",
-    "type": "function"
-  },
   {
     "inputs": [
       {

diff --git a/contracts/interfaces/IWConvexPools.sol b/contracts/interfaces/IWConvexPools.sol
@@ -7,9 +7,10 @@ import "@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol";
 
 import "./IERC20Wrapper.sol";
 import "./convex/ICvxPools.sol";
+import "./convex/IConvex.sol";
 
 interface IWConvexPools is IERC1155Upgradeable, IERC20Wrapper {
-    function CVX() external view returns (IERC20Upgradeable);
+    function CVX() external view returns (IConvex);
 
     /// @dev Mint ERC1155 token for the given ERC20 token.
     function mint(uint gid, uint amount) external returns (uint id);

diff --git a/contracts/interfaces/convex/IConvex.sol b/contracts/interfaces/convex/IConvex.sol
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity 0.8.16;
+
+import "@openzeppelin/contracts-upgradeable/token/ERC20/extensions/IERC20MetadataUpgradeable.sol";
+
+interface IConvex is IERC20MetadataUpgradeable {
+    function reductionPerCliff() external view returns (uint256);
+
+    function totalCliffs() external view returns (uint256);
+
+    function maxSupply() external view returns (uint256);
+}
diff --git a/contracts/spell/ConvexSpell.sol b/contracts/spell/ConvexSpell.sol
@@ -132,9 +132,14 @@ contract ConvexSpell is BasicSpell {
                 revert Errors.INCORRECT_PID(param.farmingPoolId);
             if (pos.collToken != address(wConvexPools))
                 revert Errors.INCORRECT_COLTOKEN(pos.collToken);
+            (address[] memory rewardTokens, ) = IERC20Wrapper(pos.collToken)
+                .pendingRewards(pos.collId, pos.collateralSize);
             bank.takeCollateral(pos.collateralSize);
             wConvexPools.burn(pos.collId, pos.collateralSize);
-            _doRefundRewards(CVX);
+            // distribute multiple rewards to users
+            for (uint256 i; i < rewardTokens.length; i++) {
+                _doRefundRewards(rewardTokens[i]);
+            }
         }
 
         // 7. Deposit on Convex Pool, Put wrapped collateral tokens on Blueberry Bank
@@ -172,6 +177,7 @@ contract ConvexSpell is BasicSpell {
         // 2. Swap rewards tokens to debt token
         for (uint256 i = 0; i < rewardTokens.length; i++) {
             uint256 rewards = _doCutRewardsFee(rewardTokens[i]);
+
             _ensureApprove(rewardTokens[i], address(swapRouter), rewards);
             swapRouter.swapExactTokensForTokens(
                 rewards,