# AaveV3 RewardsController provides rewards in any token, should be handled separately Crit/High · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-H01 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description The RewardsController from AaveV3 rewards are separate from the yield accrued and can be [several different tokens](https://docs.aave.com/developers/whats-new/multiple-rewards-and-claim). Thus, they should be handled differently. ### Recommendation Add a separate function in AaveV3Strategy that allows us to claim the rewards. Returning the rewards is optional, depending on the option chosen below. If a strategy has no extra rewards to be claimed, add the function but only return from it to keep compatibility. The ReservePool might end up with tokens other than WAVAX due to the fact that the rewards distributed might be any token. To address this, there are several options: 1. Add a claim rewards function that sends all rewards to the network wallet, so it can swap for wAVAX and increase the network balance. 2. Add a swap function in the ReservePool that swaps all the rewards assets different than WAVAX for WAVAX. If the swap fails, send to the addresses.networkWalletAddress(). ### Status Issue addressed by implementing method 1 in [commit:#3a4239f](https://github.com/threesigmaxyz/glacier-contracts-foundry/commit/3a4239ffe636d2f30738371b5b2bd3aafcde63dc) . --- Related findings: - [Aave RewardsController can add Usdc to the rewards list and the strategy has no way to collect the rewards](https://0xsimao.com/findings/maple-finance-iv-aave-rewards-usdc-way): Maple Cash Strategies - [`rewardData.releaseRate` is incorrectly calculated on `RewardsController::config()` when `block.timestamp > start` and `rewardData.lastConfig != rewardData.start`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-reward-release-rewards-timestamp): Exactly Protocol Update - Staking Contract - [Rewards can disappear when new rewards are distributed in the RewardsController.](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-rewards-disappear-distributed-controller): Exactly Protocol Update - Staking Contract