# ConvexSpell/CurveSpell.openPositionFarm will revert in some cases

CurveSpell/ConvexSpell.openPositionFarm approves only borrowBalance but supplies full token balance, so a 1-wei donation makes add_liquidity revert, blocking position opening.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: nobody2018
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/60
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:accounting-error vuln:dos

**Target:** CurveSpell/ConvexSpell openPositionFarm liquidity-add flow
**Root cause:** suppliedAmts uses IERC20.balanceOf(address(this)) instead of borrowBalance, while _ensureApprove only approves borrowBalance; any pre-existing token balance makes add_liquidity's transferFrom exceed allowance and revert.
**Steps:**
1. Attacker transfers 1 wei of borrowToken (or both pool tokens) to the CurveSpell/ConvexSpell contract, optionally front-running the victim.
2. Victim calls BlueBerryBank#execute -> CurveSpell#openPositionFarm.
3. _doBorrow borrows 100e18 A; borrowBalance=100e18.
4. _ensureApprove approves pool for 100e18.
5. suppliedAmts[i] = balanceOf(address(this)) = 100e18+1 wei.
6. ICurvePool.add_liquidity pulls 100e18+1 wei, exceeding allowance, transferFrom reverts, whole tx reverts.
**How found:** Noticed the prior contest's fix used balanceOf instead of borrowBalance, then reasoned that borrowBalance can be smaller than the contract's token balance, causing an approval/amount mismatch.
**Exploitation:** Griefing: donate 1 wei of the borrow token to the spell contract (or front-run) so every openPositionFarm call computes suppliedAmts above the approved borrowBalance and reverts, denying position opening for users.
**Insight:** When a contract approves X but spends balanceOf(this), any external token donation breaks the invariant; check for approve-vs-balance mismatches in liquidity-add flows as a griefing vector.