highLogic errorEVM-Solidity
Amphora Protocol: crvRewardsContract `getReward` can be called directly, breaking vaults `claimRewards` functionallity
- Payout
- $0
- Protocol
- Amphora Protocol
- Disclosed
- Apr 22, 2024
- Source
- code4rena
The Amphora Protocol's Vault relies on an external Convex Finance contract to claim rewards for staked Curve LP positions. Because Convex allows any user to trigger the reward distribution for any address, an attacker can prematurely trigger the claiming proce …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2023-07-amphora-findings/issues/301
- https://github.com/code-423n4/2023-07-amphora-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.