Incorrect handling of Stash Tokens within the `ConvexRewardsAdapter._claimRewards()`
The primary task of the `ConvexRewardAdapter._claimRewards()` function revolves around claiming rewards for Convex/Aura staked LP tokens.\\n```\\nfunction _claimRewards(\\n    address gauge,\\n    address defaultToken,\\n    address sendTo\\n) internal returns (uint256[] memory amounts, address[] memory tokens) {\\n    // rest of code \\n\\n    // Record balances before claiming\\n    for (uint256 i = 0; i < totalLength; ++i) {\\n        // The totalSupply check is used to identify stash tokens, which can\\n        // substitute as rewardToken but lack a "balanceOf()"\\n        if (IERC20(rewardTokens[i]).totalSupply() > 0) {\\n            balancesBefore[i] = IERC20(rewardTokens[i]).balanceOf(account);\\n        }\\n    }\\n\\n    // Claim rewards\\n    bool result = rewardPool.getReward(account, /*_claimExtras*/ true);\\n    if (!result) {\\n        revert RewardAdapter.ClaimRewardsFailed();\\n    }\\n\\n    // Record balances after claiming and calculate amounts claimed\\n    for (uint256 i = 0; i < totalLength; ++i) {\\n        uint256 balance = 0;\\n        // Same check for "stash tokens"\\n        if (IERC20(rewardTokens[i]).totalSupply() > 0) {\\n            balance = IERC20(rewardTokens[i]).balanceOf(account);\\n        }\\n\\n        amountsClaimed[i] = balance - balancesBefore[i];\\n\\n        if (sendTo != address(this) && amountsClaimed[i] > 0) {\\n            IERC20(rewardTokens[i]).safeTransfer(sendTo, amountsClaimed[i]);\\n        }\\n    }\\n\\n    RewardAdapter.emitRewardsClaimed(rewardTokens, amountsClaimed);\\n\\n    return (amountsClaimed, rewardTokens);\\n}\\n```\\n\\nAn intriguing aspect of this function's logic lies in its management of "stash tokens" from AURA staking. The check to identify whether `rewardToken[i]` is a stash token involves attempting to invoke `IERC20(rewardTokens[i]).totalSupply()`. If the returned total supply value is `0`, the implementation assumes the token is a stash token and bypasses it. However, this check is flawed since the total supply of stash tokens can indeed be non-zero. For instance, at this address, the stash token has `totalSupply = 150467818494283559126567`, which is definitely not zero.\\nThis misstep in checking can potentially lead to a Denial-of-Service (DOS) situation when calling the `claimRewards()` function. This stems from the erroneous attempt to call the `balanceOf` function on stash tokens, which lack the `balanceOf()` method. Consequently, such incorrect calls might incapacitate the destination vault from claiming rewards from AURA, resulting in protocol losses.
To accurately determine whether a token is a stash token, it is advised to perform a low-level `balanceOf()` call to the token and subsequently validate the call's success.
The `AuraRewardsAdapter.claimRewards()` function could suffer from a Denial-of-Service (DOS) scenario.\\nThe destination vault's ability to claim rewards from AURA staking might be hampered, leading to protocol losses.
```\\nfunction _claimRewards(\\n    address gauge,\\n    address defaultToken,\\n    address sendTo\\n) internal returns (uint256[] memory amounts, address[] memory tokens) {\\n    // rest of code \\n\\n    // Record balances before claiming\\n    for (uint256 i = 0; i < totalLength; ++i) {\\n        // The totalSupply check is used to identify stash tokens, which can\\n        // substitute as rewardToken but lack a "balanceOf()"\\n        if (IERC20(rewardTokens[i]).totalSupply() > 0) {\\n            balancesBefore[i] = IERC20(rewardTokens[i]).balanceOf(account);\\n        }\\n    }\\n\\n    // Claim rewards\\n    bool result = rewardPool.getReward(account, /*_claimExtras*/ true);\\n    if (!result) {\\n        revert RewardAdapter.ClaimRewardsFailed();\\n    }\\n\\n    // Record balances after claiming and calculate amounts claimed\\n    for (uint256 i = 0; i < totalLength; ++i) {\\n        uint256 balance = 0;\\n        // Same check for "stash tokens"\\n        if (IERC20(rewardTokens[i]).totalSupply() > 0) {\\n            balance = IERC20(rewardTokens[i]).balanceOf(account);\\n        }\\n\\n        amountsClaimed[i] = balance - balancesBefore[i];\\n\\n        if (sendTo != address(this) && amountsClaimed[i] > 0) {\\n            IERC20(rewardTokens[i]).safeTransfer(sendTo, amountsClaimed[i]);\\n        }\\n    }\\n\\n    RewardAdapter.emitRewardsClaimed(rewardTokens, amountsClaimed);\\n\\n    return (amountsClaimed, rewardTokens);\\n}\\n```\\n