veCVXStrategy: Unused return outputs from _processRewardsFees()

[code423n4]

Handle

hickuphh3

Vulnerability details

Impact

In harvest(), the return values governancePerformanceFee and strategistPerformanceFee from calling _processRewardsFees() are unused. Their declarations are therefore redundant.

They can also be removed from _processRewardsFees()

Recommended Mitigation Steps

// in harvest()
function harvest() public whenNotPaused returns (uint256 harvested) {
	...
	// Because we are using bCVX we take fees in reward
	//NOTE: This will probably revert because we deposit and transfer on same block
	_processRewardsFees(earnedReward, reward);
	...
}

// Note the removal of governanceRewardsFee and strategistRewardsFee
function _processRewardsFees(uint256 _amount, address _token) internal {
	// process governance fee
	_processFee(
	  _token,
	  _amount,
	  performanceFeeGovernance,
	  IController(controller).rewards()
	);

	// process strategist fee
	_processFee(
	  _token,
	  _amount,
	  performanceFeeStrategist,
	  strategist
	 );
}

[GalloDaSballo]

Sure