In VoterProxy the address veAsset is not added to protectedTokens[] list so it's possible to call withdraw() with veAsset address by stash protocol and withdraw veAsset Balance of VoterProxy

Lines of code Vulnerability details Impact Stash contract can withdraw extra incentive reward tokens out of VoterProxy contract. and Stash calls withdraw function of VoterProxy for extra reward tokens of gauges. but veAsset was in gauges reward tokens then Stash will call withdraw with veAsset...

In VeAssetDepositor constructor if deployer set wrong value for maxTime or if maxTime in veAsset project changes then funds can be locked in VeAssetDepositor and contract will be in broken state

Lines of code Vulnerability details Impact Contract VeAssetDepositor locks funds in veAsset Project for maxTime. veAsset project has his own maxTime and users can lock tokens bigger than that amount if they try to that the transaction will fail. in VeAssetDepositor's constructor the deployer set...

veAsset are locked forever if users are periodically deposit new veAsset or calling lockVeAsset

Lines of code Vulnerability details Impact veAsset are locked forever if users are periodically deposit new veAsset or calling lockVeAsset. VeAssetDepositor also doesn't have mechanism to prevent new user from depositing or calling lockVeAsset. Which mean it will get called forever. As a result,...