# Unable to reinvest if the reward token equals one of the pool tokens

Notional vault's reinvestReward reverts when a reward token (e.g. CRV, AURA) is also a pool token, blocking reward compounding and causing shareholder asset loss.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: coffiasd
- Disclosed: 2023-10-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-notional-judging/issues/84
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SingleSidedLPVaultBase / AuraStakingMixin / ConvexStakingMixin reward reinvestment
**Root cause:** _isInvalidRewardToken rejects any reward token that equals a pool token, but executeRewardTrades requires trades.length == NUM_TOKENS() and each buyToken to match tokens[i], so a reward token that is also a pool token can never be sold/reinvested.
**Steps:**
1. Identify a Curve/Balancer pool where a reward token equals a pool token (e.g. TriCRV with CRV reward, or WETH-AURA with AURA reward).
2. Call `reinvestReward(trades, minPoolClaim)` with trades.length == NUM_TOKENS() and sellToken = the reward token.
3. Observe `_executeRewardTrades` calls `_isInvalidRewardToken(rewardToken)` which returns true because token == TOKEN_i, reverting with `Errors.InvalidRewardToken`.
4. Reward tokens accumulate in the vault and are never sold/reinvested into LP.
**How found:** Code reading of the reinvestReward flow: noticed the trades array must be indexed by pool token order and that _isInvalidRewardToken explicitly excludes pool tokens, creating a contradiction for reward tokens that are also pool tokens (e.g. CRV in TriCRV, AURA in WETH-AURA).
**Exploitation:** No attacker action; the vault's own reinvestment path is permanently blocked for such reward tokens, so rewards sit idle and vault share value does not compound, harming shareholders.
**Insight:** When a function both requires an array indexed by pool tokens and separately blacklists pool tokens as inputs, check whether any legitimate input can satisfy both constraints simultaneously; reward tokens that double as pool tokens are common in Curve/Convex/Aura pools.