BPT LP Token could be sold off during re-investment
BPT LP Token could be sold off during the re-investment process. BPT LP Tokens must not be sold to external DEXs under any circumstance because:\\nThey are used to redeem the underlying assets from the pool when someone exits the vault\\nThe BPTs represent the total value of the vault\\nWithin the `ConvexStakingMixin._isInvalidRewardToken` function, the implementation ensures that the LP Token (CURVE_POOL_TOKEN) is not intentionally or accidentally sold during the reinvestment process.\\n```\\nFile: ConvexStakingMixin.sol\\n    function _isInvalidRewardToken(address token) internal override view returns (bool) {\\n        return (\\n            token == TOKEN_1 ||\\n            token == TOKEN_2 ||\\n            token == address(CURVE_POOL_TOKEN) ||\\n            token == address(CONVEX_REWARD_POOL) ||\\n            token == address(CONVEX_BOOSTER) ||\\n            token == Deployments.ALT_ETH_ADDRESS\\n        );\\n    }\\n```\\n\\nHowever, the same control was not implemented for the Balancer/Aura code. As a result, it is possible for LP Token (BPT) to be sold during reinvestment. Note that for non-composable Balancer pools, the pool tokens does not consists of the BPT token. Thus, it needs to be explicitly defined within the `_isInvalidRewardToken` function.\\n```\\nFile: AuraStakingMixin.sol\\n    function _isInvalidRewardToken(address token) internal override view returns (bool) {\\n        return (\\n            token == TOKEN_1 ||\\n            token == TOKEN_2 ||\\n            token == TOKEN_3 ||\\n            token == TOKEN_4 ||\\n            token == TOKEN_5 ||\\n            token == address(AURA_BOOSTER) ||\\n            token == address(AURA_REWARD_POOL) ||\\n            token == address(Deployments.WETH)\\n        );\\n    }\\n```\\n\\nPer the sponsor's clarification below, the contracts should protect against the bot doing unintended things (including acting maliciously) due to coding errors, which is one of the main reasons for having the `_isInvalidRewardToken` function. Thus, this issue is a valid bug in the context of this audit contest.\\n
Ensure that the LP tokens cannot be sold off during re-investment.\\n```\\nfunction _isInvalidRewardToken(address token) internal override view returns (bool) {\\n    return (\\n        token == TOKEN_1 ||\\n        token == TOKEN_2 ||\\n        token == TOKEN_3 ||\\n        token == TOKEN_4 ||\\n        token == TOKEN_5 ||\\n// Add the line below\\n       token == BALANCER_POOL_TOKEN ||\\n        token == address(AURA_BOOSTER) ||\\n        token == address(AURA_REWARD_POOL) ||\\n        token == address(Deployments.WETH)\\n    );\\n}\\n```\\n
LP tokens (BPT) might be accidentally or maliciously sold off by the bots during the re-investment process. BPT LP Tokens must not be sold to external DEXs under any circumstance because:\\nThey are used to redeem the underlying assets from the pool when someone exits the vault\\nThe BPTs represent the total value of the vault
```\\nFile: ConvexStakingMixin.sol\\n    function _isInvalidRewardToken(address token) internal override view returns (bool) {\\n        return (\\n            token == TOKEN_1 ||\\n            token == TOKEN_2 ||\\n            token == address(CURVE_POOL_TOKEN) ||\\n            token == address(CONVEX_REWARD_POOL) ||\\n            token == address(CONVEX_BOOSTER) ||\\n            token == Deployments.ALT_ETH_ADDRESS\\n        );\\n    }\\n```\\n