# Pending CRV rewards are not accounted for and can cause unfair liquidations

WCurveGauge.pendingRewards returns empty arrays, so pending CRV rewards are excluded from position valuation, enabling unfair liquidations of healthy users.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-04-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-blueberry-judging/issues/136
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** WCurveGauge wrapper / BlueBerryBank position valuation
**Root cause:** WCurveGauge#pendingRewards is a stub returning empty arrays, so BlueBerryBank's collateral valuation omits pending CRV rewards that legitimately add value to a position.
**Steps:**
1. Open a position with WCurveGauge collateral via BlueBerryBank
2. Accrue pending CRV rewards on the gauge position
3. Call BlueBerryBank valuation which invokes IERC20Wrapper(pos.collToken).pendingRewards(pos.collId, pos.collateralSize)
4. Observe WCurveGauge returns empty tokens/rewards arrays, so rewardsValue contribution is zero
5. Liquidate the position that would be healthy if pending rewards were counted
**How found:** Code reading: noticed BlueBerryBank adds pendingRewards to position value, then inspected WCurveGauge#pendingRewards and found it returns empty arrays, breaking the valuation assumption.
**Exploitation:** A liquidator calls the liquidation path on a position whose true value (including pending CRV rewards) exceeds the threshold; because pendingRewards returns empty, the position is valued lower and passes the unhealthy check, allowing the liquidator to seize collateral.
**Insight:** When a bank/valuation contract trusts a wrapper's pendingRewards to price collateral, audit every wrapper implementation for stubs or partial implementations that silently return empty/zero — a no-op view function becomes a liquidation vector.