# [WP-M1] getRewards() can be triggered by external parties which will result in the rewards not be tracking properly by the system

Anyone can call ConvexRewardPool.getReward for a Sentiment account, keeping unclaimed rewards low so reward tokens never enter the account's asset list, enabling wrongful liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: WATCHPUG
- Disclosed: 2022-11-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-12-sentiment-judging/issues/15
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:liquidation

**Target:** ConvexBoosterController / ConvexRewardPool reward accounting
**Root cause:** Reward tokens are only added to an account's asset list when getReward() is called via AccountManager, but ConvexRewardPool#getReward(address) is callable by anyone, so a third party can claim rewards before the owner does and the tokens never get registered as assets.
**Steps:**
1. Victim account holds Convex reward pool position with unclaimed rewards not yet in asset list
2. Attacker calls `ConvexRewardPool.getReward(victimAccount)` directly (permissionless)
3. Rewards are transferred out/claimed without going through AccountManager, so reward tokens are never added to the account's assets list
4. Repeat periodically to keep unclaimed rewards near zero
5. Account's tracked total assets understate real holdings; liquidator liquidates the account despite sufficient real assets
**How found:** Code review of ConvexBoosterController.canDeposit and the ConvexRewardPool contract: noticed reward tokens are only appended to the asset list on getReward(), and that getReward(address) lacks an owner-only check, making the accounting externally manipulable.
**Exploitation:** Attacker (or any helper) repeatedly calls getReward on the victim's account so reward tokens are never registered as assets; the account appears undercollateralized and can be liquidated even though real assets suffice.
**Insight:** When a protocol's asset accounting depends on a claim function to register tokens, check whether that claim function is permissionless — an external caller can suppress registration and skew collateral/liquidation math.