Submitted by certora
https://github.com/code-423n4/2021-12-sublime/blob/main/contracts/Pool/Pool.sol#L645
if the borrow token is address(0) (ether), and someone calls withdrawLiquidity, it calls SavingsAccountUtil.transferTokens which will transfer to msg.sender, msg.value (of withdrawLiquidity, because its an internal function). In other words, the liquidity provided will pay to themselves and their liquidity tokens will still be burned. therefore they will never be able to get their funds back.
the bug is in
https://github.com/code-423n4/2021-12-sublime/blob/main/contracts/SavingsAccount/SavingsAccountUtil.sol
It is wrong to use msg.value in transferTokens because itll be the msg.value of the calling function.
therefore every transfer of ether using this function is wrong and dangerous, the solution is to remove all msg.value from this function and just transfer _amount regularly.
**ritik99 (Sublime) confirmed **
