No withdraw mechanism for crvUSD in stability pool contract leads to risk of crvUSD being stuck in stability pool contract
Summary
crvUSD is required to perform liquidation through liquidateBorrower function in the stability pool. As per the documentation and the code, we don't know who is in charge of funding the stability pool in crvUSD.
The issue is that there is no function or mechanism that allows to transfer crvUSD from the contract to another address.
This is problematic as it can lead to crvUSD being stuck in this contract.
Impact
The impact of this issue is medium as there is no direct theft of funds, but a possibility to have crvUSD left in the contract without liquidations to perform for any reason. This might lead to crvUSD (reserve asset) being stuck in the stability pool.
Tools Used
Manual review.
Recommendations
Make sure to include a mechanism to allow token withdrawals (or more specifically reserve asset withdrawal) in the stability pool.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.