Summary

Tokens stuck in smart contract

Vulnerability Details

Users who may wrongly understand that the way to interact with protocol is to send in WBTC or WETH may instead send directly to protocol address instead of interacting with the allowed functions.

Impact

Low: Sending tokens directly results in users tokens stuck in the contracts as there is no way to record who sent and to send them back to the user who deposited the tokens directly

Tools Used

Manual Analysis

Recommendations

Sufficient communication that to interact with protocol users need to call only protocol function e.g depositCollateral
Tokens could be distributed to users by intergating (token.balanceOf(address(this))) into the protocol dynamics etc