Aura/Convex rewards are stuck after DOS
Anyone can claim Convex rewards for any account.\\n```\\nfunction getReward(address _account, bool _claimExtras) public updateReward(_account) returns(bool){\\n    uint256 reward = earned(_account);\\n    if (reward > 0) {\\n        rewards[_account] = 0;\\n        rewardToken.safeTransfer(_account, reward);\\n        IDeposit(operator).rewardClaimed(pid, _account, reward);\\n        emit RewardPaid(_account, reward);\\n    }\\n\\n    //also get rewards from linked rewards\\n    if(_claimExtras){\\n        for(uint i=0; i < extraRewards.length; i++){\\n            IRewards(extraRewards[i]).getReward(_account);\\n        }\\n    }\\n    return true;\\n}\\n```\\n\\nIn ConvexRewardsAdapter, the rewards are accounted for by using balanceBefore/after.\\n```\\nfunction _claimRewards(\\n    address gauge,\\n    address defaultToken,\\n    address sendTo\\n) internal returns (uint256[] memory amounts, address[] memory tokens) {\\n\\n  uint256[] memory balancesBefore = new uint256[](totalLength);\\n    uint256[] memory amountsClaimed = new uint256[](totalLength);\\n// rest of code\\n\\n  for (uint256 i = 0; i < totalLength; ++i) {\\n        uint256 balance = 0;\\n        // Same check for "stash tokens"\\n        if (IERC20(rewardTokens[i]).totalSupply() > 0) {\\n            balance = IERC20(rewardTokens[i]).balanceOf(account);\\n        }\\n\\n        amountsClaimed[i] = balance - balancesBefore[i];\\n\\n return (amountsClaimed, rewardTokens);\\n```\\n\\nAdversary can call the external convex contract's `getReward(tokemakContract)`. After this, the reward tokens are transferred to Tokemak without an accounting hook.\\nNow, when Tokemak calls claimRewards, then no new rewards are transferred, because the attacker already transferred them. `amountsClaimed` will be 0.
Don't use balanceBefore/After. You could consider using `balanceOf(address(this))` after claiming to see the full amount of tokens in the contract. This assumes that only the specific rewards balance is in the contract.
Rewards are stuck in the LiquidationRow contract and not queued to the MainRewarder.
```\\nfunction getReward(address _account, bool _claimExtras) public updateReward(_account) returns(bool){\\n    uint256 reward = earned(_account);\\n    if (reward > 0) {\\n        rewards[_account] = 0;\\n        rewardToken.safeTransfer(_account, reward);\\n        IDeposit(operator).rewardClaimed(pid, _account, reward);\\n        emit RewardPaid(_account, reward);\\n    }\\n\\n    //also get rewards from linked rewards\\n    if(_claimExtras){\\n        for(uint i=0; i < extraRewards.length; i++){\\n            IRewards(extraRewards[i]).getReward(_account);\\n        }\\n    }\\n    return true;\\n}\\n```\\n