# totalReserves should be fetched from the strategies individually and summed up in the ReservePool Crit/High · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-H02 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description Currently totalReserves is updated based on deposits and withdrawal amounts to the reservePool. This means that rewards accrued in the strategies will not be accounted for, effectively not earning any yield. In the case of AaveV3, the rewards from the RewardsController are separate from the accrued yield from supplying, so only the former would be accounted for. ### Recommendation totalReserves should be fetched individually from each strategy and summed up. One way to achieve this is by changing totalReserves() in ReservePool to fetch balances from all strategies . And in the AaveV3Strategy there should be a function getBalance() that takes into account the yield accrued. ### Status This issue has been addressed in commit: [#4bb9844](https://github.com/threesigmaxyz/glacier-contracts-foundry/commit/4bb98443a617fcb95418986c6bc7cb54e06f29ea). --- Related findings: - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires): Cork Protocol