# WConvexPool.sol will be broken on Arbitrum due to improper integration with Convex Arbitrum contracts

WConvexPool destructures 6 values from Convex Booster poolInfo() but Arbitrum's Booster returns 5, reverting mint/burn/pendingRewards and breaking Convex integration.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: Kow
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/119
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:misconfiguration

**Target:** WConvexPool.sol / ConvexSpell wrapper integrating Convex Booster
**Root cause:** WConvexPool assumes mainnet Convex Booster ABI (6-field PoolInfo, deposit with 3 args, withdraw) but Arbitrum Booster returns 5 fields and uses withdrawTo with different args, so destructuring and calls revert.
**Steps:**
1. Deploy WConvexPool to Arbitrum against Booster 0xF403C135812408BFbE8713b5A23a04b3D48AAE31
2. Call getPoolInfoFromPoolId which destructures 6 return values from cvxPools.poolInfo()
3. Arbitrum poolInfo returns only 5 values -> call reverts
4. pendingRewards, mint, burn all revert, disabling ConvexSpell position management
5. cvxPools.deposit(...) and withdraw(...) also mismatch Arbitrum signatures (withdrawTo, 2-arg deposit)
**How found:** Code review comparing WConvexPool's Convex integration against Arbitrum Booster source/docs, spotting the PoolInfo struct and deposit/withdraw signature differences between mainnet and sidechain contracts.
**Insight:** When a wrapper is deployed to multiple chains, diff the target protocol's per-chain contract source (struct fields and function signatures) rather than assuming the mainnet ABI; a struct field count change silently breaks destructuring.