# StrategyPUSDConvex.balanceOfJPEG uses incorrect function signature while calling extraReward.earned, causing the function to unexpectedly revert everytime

StrategyPUSDConvex.balanceOfJPEG called Convex extraReward.earned() without the required address argument, reverting and bricking the entire JPEG'd farming vault.

- Payout: Audit contest
- Severity: high
- Program: JPEG'd
- Credited: rayn
- Disclosed: 2022-06-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-jpegd-findings/issues/139
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-08
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** StrategyPUSDConvex.sol balanceOfJPEG / Convex BaseRewardPool integration
**Root cause:** balanceOfJPEG calls extraReward.earned() with no arguments, but Convex's earned(address) requires an account parameter, so the call always reverts.
**Steps:**
1. Read Convex BaseRewardPool/VirtualBalanceRewardPool: `earned(address account)` takes an address.
2. Inspect StrategyPUSDConvex.balanceOfJPEG: `availableBalance += extraReward.earned();` passes no argument.
3. Call balanceOfJPEG() -> ABI decode/revert due to missing arg.
4. Trace propagation: Controller -> YVault -> YVaultLPFarming._computeUpdate all revert, bricking farming.
**How found:** Code review comparing the strategy's call site against Convex's actual reward pool function signatures; noticed earned() invoked with zero args while the interface requires an address.
**Exploitation:** Not an attacker-driven exploit; the faulty view function reverts on every call, propagating through Controller/YVault to YVaultLPFarming._computeUpdate and rendering the farming contract unusable (judge: loss of funds).
**Insight:** When integrating third-party reward pools, diff every external call's argument list against the actual deployed contract signature (Convex earned(address)); a missing arg in a view used by accounting logic bricks the whole vault, not just the view.