# Incorrect handling of Stash Tokens within the `ConvexRewardsAdapter._claimRewards()`

ConvexRewardsAdapter._claimRewards uses totalSupply()>0 to detect stash tokens, but stash tokens have nonzero supply and no balanceOf(), causing claimRewards DoS.

- Payout: Contest reward
- Severity: medium
- Program: Tokemak
- Credited: duc
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/632
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** ConvexRewardsAdapter._claimRewards reward-claiming adapter
**Root cause:** Stash tokens are identified by checking totalSupply() > 0, but stash tokens can have nonzero total supply and lack a balanceOf() method, so the balanceOf call reverts.
**Steps:**
1. Observe _claimRewards loops over rewardTokens and calls IERC20(rewardTokens[i]).totalSupply() to filter stash tokens
2. Note stash token 0x2f5c611420c8ba9e7ec5c63e219e3c08af42a926 has totalSupply = 150467818494283559126567 (nonzero)
3. Because supply > 0, code proceeds to call IERC20(rewardTokens[i]).balanceOf(account) on the stash token
4. Stash token has no balanceOf(), so the call reverts, reverting the whole claimRewards flow
**How found:** Code review of the stash-token heuristic; verified on-chain that a real stash token has nonzero totalSupply, invalidating the assumption.
**Insight:** When filtering heterogeneous token arrays by capability, don't infer interface support from state values like totalSupply; probe the actual function with a low-level staticcall and check success.