# Protocol unable to get extra Rewards in OCY_Convex_C

OCY_Convex_C reads extra-reward balance from Convex's StashTokenWrapper instead of the underlying token, so pool-270 extra rewards are never forwarded to Zivoe.

- Payout: Contest reward
- Severity: high
- Program: Zivoe
- Credited: BoRonGod
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/477
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** OCY_Convex_C.sol claimRewards extra-reward loop (Convex pool 270)
**Root cause:** For Convex pools with ID 151+, extraRewards rewardToken() returns a StashTokenWrapper, not the underlying reward token. The code calls balanceOf on the wrapper address instead of rewardToken().token(), so the balance is always zero.
**Steps:**
1. Note convexPoolID = 270 in OCY_Convex_C, which is >= 151.
2. Call claimRewards(true): getReward() unwraps and sends underlying tokens to the locker.
3. Loop reads `IBaseRewardPool(rewardContract).rewardToken().balanceOf(address(this))` — the wrapper holds 0.
4. rewardAmount == 0, so safeTransfer is skipped and extra rewards stay stranded.
**How found:** Read Convex docs noting pools 151+ use StashTokenWrapper for extra reward tokens, then verified on-chain that pool 270's extraRewards[0].rewardToken() is a StashTokenWrapper, contradicting the code's assumption that rewardToken() is the token itself.
**Insight:** When integrating a rewards contract, verify whether rewardToken() returns the token or a wrapper/stash contract for the specific pool ID range; check the actual on-chain extraRewards entries rather than assuming uniform behavior across pool IDs.