Owner Cannot Rescue `rToken` and `rAacToken` in Emergency Situations in `StabilityPool` contract
Summary
The StabilityPool contract currently lacks a mechanism for the owner to rescue rToken and raacToken. This could lead to situations where these tokens become stuck due to unforeseen contract behavior or emergency situations, preventing the owner from recovering them when necessary.
Vulnerability Details
The contract can be paused during emergency situations to prevent further deposits and withdrawals, but the contract does not provide a function that allows the owner to withdraw rToken and raacToken in cases the contract is paused due emergency. This restriction could lead to permanent loss of these tokens.
Impact
Without a token rescue function, the owner has no means of recovering rToken and raacToken from the contract in emergency situations.
Tools Used
Manual Review
Recommendations
Implement a rescueTokens() function to allow the owner to withdraw rToken and raacToken
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.