cccz - When finalTVL == 0, the emissionsToken in the vault will be locked

[sherlock-admin]

cccz

medium

When finalTVL == 0, the emissionsToken in the vault will be locked

Summary

When finalTVL == 0, the emissionsToken in the vault cannot be claimed and will be locked in the contract

Vulnerability Detail

When the vault is created, emissionsTokens are sent to the vault, and when the epoch ends, users can claim these emissionsTokens.

        emissionsToken.safeTransferFrom(treasury, vaults[0], _permiumEmissions);
        ICarousel(vaults[0]).setEmissions(epochId, _permiumEmissions);

        emissionsToken.safeTransferFrom(treasury, vaults[1], _collatEmissions);
        ICarousel(vaults[1]).setEmissions(epochId, _collatEmissions);

However, if the finalTVL is 0, then these emissionsTokens will not be claimed and will be locked in the contract

    function previewEmissionsWithdraw(uint256 _id, uint256 _assets)
        public
        view
        returns (uint256 entitledAmount)
    {
        entitledAmount = _assets.mulDivDown(emissions[_id], finalTVL[_id]);
    }

Impact

If the finalTVL is 0, then these emissionsTokens will not be claimed and will be locked in the contract

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/CarouselFactory.sol#L148-L152
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L630-L636

Tool used

Manual Review

Recommendation

Consider transferring the emissionsToken out of the contract when finalTVL == 0 in resolveEpoch

    function resolveEpoch(uint256 _id)
        external
        onlyController
        epochIdExists(_id)
        epochHasStarted(_id)
    {
        if (epochResolved[_id]) revert EpochAlreadyEnded();
        epochResolved[_id] = true;
        finalTVL[_id] = totalAssets(_id);
    }

Duplicate of #122