In VoterProxy the address veAsset is not added to protectedTokens[] list so it's possible to call withdraw() with veAsset address by stash protocol and withdraw veAsset Balance of VoterProxy

Lines of code Vulnerability details Impact Stash contract can withdraw extra incentive reward tokens out of VoterProxy contract. and Stash calls withdraw function of VoterProxy for extra reward tokens of gauges. but veAsset was in gauges reward tokens then Stash will call withdraw with veAsset...