Submitted by oyc109_
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L138-L143
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L274-L285
A compromised or malicious operator can withdraw all tokens by calling the function withdrawAll
The operator can also call an arbitary address with any value
jetbrain10 (veToken Finance) disputed and commented:
Alex the Entreprenerd (judge) commented:
