Fluid protocol itself provide a reward system that is rewarding its user each cycle specified. The issue is that the FluidARBUSDCStrategy is not overriding the MYTStrategy reward claim function, making the strategy unable to claim this provided rewards from Fluid protocol.
Vulnerability Details
MYTStrategy already provided claimRewards function, but it is not overrided inside FluidARBUSDCStrategy . the function claimRewards can be called but would do nothing. the details can be seen in the PoC section.
Impact Details
potential protocol and user losses because the reward cannot be claimed.
the setup needs merkle proof, that we generate using this file:
the output is used on the PoC. the necessary data is already pasted into the PoC. just apply the diff:
we run on specific block fork forge test --fork-url https://arbitrum.gateway.tenderly.co --fork-block-number 395303779 --mt test_fluidStrategyCantClaimRewards
the result would be the strategy is having 50e18 fluid token as reward but by using the MYTStrategy::claimRewards that is not overrided, it cant be claimed as shown that the balance is still 0. effectively this reward would be lost.