summary

Loss of USDC tokens in the proxy contract

vulnerability details

-> Students has been sending usdc tokens to the contract when they have been enrolling . But when upgraidng only the principal and the teachers have got the 40% of the tokens and the remaining 60% remain in the contract and there is no function that has been implemented to withdraw these tokens from the proxy contract

-> We can add withdraw function in the next upgradation implementation contract , but having a withdraw in all the implementations is the better approach

impact - Medium

likelyhood - Medium

Recommendations

Implement a withdraw function to get the usdc tokens to a treasury address controlled by the school