Assets sent from MarginAccount to InsuranceFund will be locked forever #128
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
sponsor confirmed
Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
Lines of code
https://github.com/code-423n4/2022-02-hubble/blob/ed1d885d5dbc2eae24e43c3ecbf291a0f5a52765/contracts/MarginAccount.sol#L377
Vulnerability details
Impact
Assets sent from MarginAccount to InsuranceFund will be locked forever
Proof of Concept
The insurance fund doesn't have a way to transfer non-vusd out of the contract.
Assets transferred to the InsuranceFund will be locked forever.
Mitigation
Have a way for governance to sweep tokens to swap them.
The text was updated successfully, but these errors were encountered: