# AuraSpell#openPositionFarm fails to return all rewards to user

AuraSpell.openPositionFarm burns and remints a user's Aura position but refunds only AURA, stranding all other reward tokens in the contract.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-05-02
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-blueberry-judging/issues/29
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-blueberry%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AuraSpell / WAuraPools wrapper contract
**Root cause:** When adding to an existing position, AuraSpell burns the old position via wAuraPools.burn (which transfers all reward tokens to the spell contract) but only calls _doRefundRewards(AURA), leaving other reward tokens stuck in the contract.
**Steps:**
1. User has an existing AuraSpell position with collateralSize > 0.
2. User calls openPositionFarm with the same farmingPoolId to add to the position.
3. Contract calls bank.takeCollateral and wAuraPools.burn(pos.collId, pos.collateralSize).
4. WAuraPools.burn loops rewardTokens and safeTransfers all rewards to msg.sender (the spell contract).
5. AuraSpell only calls _doRefundRewards(AURA), refunding just AURA to the user.
6. All non-AURA reward tokens remain in the spell contract, lost to the user.
**How found:** Code review of the burn/refund flow: noticed WAuraPools.burn transfers the full rewardTokens array to the caller, while AuraSpell only refunds the single AURA token.
**Exploitation:** Not an external attack; the loss occurs on any legitimate top-up of an existing AuraSpell position, silently stranding non-AURA reward tokens in the contract.
**Insight:** When a wrapper burns a position that pays out multiple reward tokens, verify the caller refunds the entire rewardTokens list, not just the primary token; top-up/remint paths are where multi-token rewards get stranded.