# WAuraPools doesn't correctly account for AuraStash causing all deposits to be permanently lost

WAuraPools transfers stash AURA as a normal ERC20 on burn, but stash AURA transfers revert, permanently locking all deposits.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/108
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:accounting-error vuln:dos

**Target:** WAuraPools wrapper contract (Aura LP wrapper)
**Root cause:** WAuraPools.burn transfers every reward token directly, but stash AURA is a non-transferable token whose transfer reverts; AuraSpell handles this by substituting AURA, WAuraPools does not.
**Steps:**
1. Deposit Aura LP into WAuraPools; rewardTokens list includes STASH_AURA as a secondary reward.
2. Call burn/withdraw on WAuraPools.
3. Loop at WAuraPools.sol#L413-L418 calls `IERC20Upgradeable(rewardTokens[i]).safeTransfer(msg.sender, rewards[i])` for STASH_AURA.
4. Stash AURA transfer reverts (only pool can call, and it forwards AURA), so the whole withdraw reverts.
5. All deposits become permanently unrecoverable.
**How found:** Code reading: noticed AuraSpell explicitly maps STASH_AURA to AURA before swapping, then observed WAuraPools uses the same reward list but transfers tokens directly without that substitution.
**Exploitation:** Not an attack; a functional bug. Any user attempting to withdraw from a WAuraPool whose reward list contains stash AURA hits a reverting transfer and cannot recover their deposit.
**Insight:** When a protocol special-cases a token in one code path (AuraSpell's STASH_AURA->AURA mapping), grep for every other place the same reward/token list is consumed; wrapper/withdraw paths often miss the same special case.