Missing implementation of `_emergencyWithdraw`
Summary
The protocol does not include the _emergencyWithdraw function in its strategies. This means funds could be locked and unrecoverable during emergencies, such as an attack or system failure.
Vulnerability Details
The strategies in scope are missing the _emergencyWithdraw function. This feature is vital for retrieving funds during critical events. Without it, there is no way to safely extract assets if something goes wrong.
Impact
If the shutdownWithdraw function in the BaseStrategy contract is used, it attempts to call _emergencyWithdraw. Since this function is not defined in the strategies, the call will not work, leaving the funds inaccessible.
Tools Used
Manual Review
Recommendations
Add the _emergencyWithdraw function to all strategies to ensure funds can be withdrawn securely during emergencies.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.