0x52 - Users who deposit Lyra LP as collateral will lose OP vault rewards

[github-actions]

0x52

high

Users who deposit Lyra LP as collateral will lose OP vault rewards

Summary

Optimism currently offers yield farming opportunities for Lyra LPs, see OP Reward Announcement. Every 2 weeks Lyra LPs split a claimable pool. When they use their Lyra LP as collateral, it is transferred to the Lyra vault which means that all OP will be instead claimable by the vault. The vault currently doesn't implement any method to claim or distribute those tokens. The result is a loss of user yield on their Lyra tokens. Aside from the loss of funds, it also highly disincentivizes users from using Lyra tokens as collateral.

Vulnerability Detail

See summary.

Impact

Lyra LPs that use their tokens as collateral will lose all their OP rewards

Code Snippet

Vault_Lyra.sol

Tool used

Manual Review

Recommendation

It's unclear how long OP rewards will continue but it seems like other protocols have been getting 6 months of incentives. Since they are temporary I would recommend not integrating reward distribution directly into the contract. I would recommend adding a function to claim rewards to the Isomorph treasury. After the rewards end, the Isomorph should create an airdrop to distribute those tokens to users during that period of time.

[kree-dotcom]

Fixed, kree-dotcom/isomorph@f1b5bbc .

Added a function claimLyraRewards which allows the Vault to claim any token rewards it is eligible for. These are then sent to the admin and will be allocated to end users using a similar system that Lyra currently has of off-chain balance snapshots and a MultiDistributor.sol contract by which users claim their rewards.

[IAm0x52]

Fixes look good. Adds an admin only function that allow OP rewards to be claimed and later distributed