Core Contracts

Summary
there is no time lock to claim back the locked r token in `stabilitypool.sol` leading to a malicious user sweep all the raactoken from the contract

Vulnerability Details
due to lack of time lock after the functiondeposita malicious user can observe the contract stabilitypool know when there is the highest amount of raac present in the contract
go to the lending pool contract deposit a big amount of crvusd get r token then take that r token deposit it and then instantly withdraw it sweeping a large amount of raac from the contract and then returing the r token and making a huge profit with a large amount of raac and just spending a little amount of crv
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L224

Impact
sweep all the raac from the contract stability pool

Tools Used
manual audit

Recommendations
add a time lock to withdraw in stability pool