Sneaky Zinc Narwhal - the _getYieldFees can be bypassed

[sherlock-admin3]

Sneaky Zinc Narwhal

High

the _getYieldFees can be bypassed

Summary

the _getYieldFees fee amount can be bypassed by using the function depositRewards instead of depositFromPairedLpToken in the contract **TokenReward ** in the function depositFromPairedLpToken if LEAVE_AS_PAIRED_LP_TOKEN is turned to true it will subtract _getYieldFees percentage but if the LEAVE_AS_PAIRED_LP_TOKEN is turned on we can still bypass it by using the depositRewards function with PAIRED_LP_TOKEN token argument
https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/TokenRewards.sol#L180

Root Cause

the depositRewards function doesnlt have a yieldfee calculaltion if the token is PAIRED_LP_TOKEN

Internal Pre-conditions

LEAVE_AS_PAIRED_LP_TOKEN have to be true

External Pre-conditions

nothing

Attack Path

nothing

Impact

fee will not be collected

PoC

No response

Mitigation

No response