Submitted by rbserver, also found by ladboy233, hansfriese, and 0xjuicer
https://github.com/code-423n4/2023-01-popcorn/blob/main/src/vault/adapter/abstracts/AdapterBase.sol#L210-L235 
https://github.com/code-423n4/2023-01-popcorn/blob/main/src/vault/adapter/yearn/YearnAdapter.sol#L166-L172 
https://github.com/yearn/yearn-vaults/blob/master/contracts/Vault.vy#L1028-L1167
For a vault that uses the YearnAdapter contract as its adapter, calling the Vault.withdraw or Vault.redeem function will eventually call the AdapterBase._withdraw and YearnAdapter._protocolWithdraw functions below when the adapter is not paused. When the YearnAdapter._protocolWithdraw function executes yVault.withdraw(convertToUnderlyingShares(assets, shares)), the maxLoss input is not specified when calling the Yearn vaults withdraw function below. Thus, the Yearn vaults withdraw function will be called with its default maxLoss input value that is 0.01%. If the total loss incurred during the withdrawal is more than 0.01%, calling the Yearn vaults withdraw function that executes assert totalLoss <= maxLoss * (value + totalLoss) / MAX_BPS will revert. In a bear market, it is possible that the Yearn vaults strategies do not perform well so the total loss can be more than 0.01% permanently. In this situation, calling the Vault.withdraw or Vault.redeem function will always revert because calling the Yearn vaults withdraw function without specifying the maxLoss input reverts. As a result, users lose the deposited assets that they are unable to withdraw.
https://github.com/code-423n4/2023-01-popcorn/blob/main/src/vault/adapter/abstracts/AdapterBase.sol#L210-L235
https://github.com/code-423n4/2023-01-popcorn/blob/main/src/vault/adapter/yearn/YearnAdapter.sol#L166-L172
https://github.com/yearn/yearn-vaults/blob/master/contracts/Vault.vy#L1028-L1167
The following steps can occur for the described scenario.
VS Code
The YearnAdapter._protocolWithdraw function can be updated to add an additional input that would be used as the maxLoss input for calling the Yearn vaults withdraw function. The other functions that call the YearnAdapter._protocolWithdraw function need to add this input as well.
RedVeil (Popcorn) confirmed, but disagreed with severity 
LSDan (judge) decreased severity to Medium 
