Vulnerability: Protocol Reserve Within A LToken Vault Can Be Lent Out
Severity: medium

Description:
Protocol reserve, which serves as a liquidity backstop or to compensate the protocol, within a LToken vault can be lent out to the borrowers.\\nThe purpose of the protocol reserve within a LToken vault is to compensate the protocol or serve as a liquidity backstop. However, based on the current setup, it is possible for the protocol reserve within a Ltoken vault to be lent out.\\nThe following functions within the `LToken` contract show that the protocol reserve is intentionally preserved by removing the protocol reserve from the calculation of total assets within a `LToken` vault. As such, whenever the Liquidity Providers (LPs) attempt to redeem their LP token, the protocol reserves will stay intact and will not be withdrawn by the LPs.\\n```\\nfunction totalAssets() public view override returns (uint) {\\n    return asset.balanceOf(address(this)) + getBorrows() - getReserves();\\n}\\n```\\n\\n```\\nfunction getBorrows() public view returns (uint) {\\n    return borrows + borrows.mulWadUp(getRateFactor());\\n}\\n```\\n\\n```\\nfunction getReserves() public view returns (uint) {\\n    return reserves + borrows.mulWadUp(getRateFactor())\\n    .mulWadUp(reserveFactor);\\n}\\n```\\n\\nHowever, this measure is not applied consistently across the protocol. The following `lendTo` function shows that as long as the borrower has sufficient collateral to ensure their account remains healthy, the borrower could borrow as many assets from the LToken vault as they wish.\\nIn the worst-case scenario, the borrower can borrow all the assets from the LToken vault, including the protocol reserve.\\n```\\nFile: LToken.sol\\n    /**\\n        @notice Lends a specified amount of underlying asset to an account\\n        @param account Address of account\\n        @param amt Amount of token to lend\\n        @return isFirstBorrow Returns if the account is borrowing the asset for\\n            the first time\\n    */\\n    function lendTo(address account, uint amt)\\n        external\\n        whenNotPaused\\n        accountManagerOnly\\n        returns (bool isFirstBorrow)\\n    {\\n        updateState();\\n        isFirstBorrow = (borrowsOf[account] == 0);\\n\\n        uint borrowShares;\\n        require((borrowShares = convertAssetToBorrowShares(amt)) != 0, "ZERO_BORROW_SHARES");\\n        totalBorrowShares += borrowShares;\\n        borrowsOf[account] += borrowShares;\\n\\n        borrows += amt;\\n        asset.safeTransfer(account, amt);\\n        return isFirstBorrow;\\n    }\\n```\\n

Impact:
The purpose of the protocol reserve within a LToken vault is to compensate the protocol or serve as a liquidity backstop. Without the protocol reserve, the protocol will become illiquidity, and there is no fund to compensate the protocol.

Recommended mitigation:
Issue Protocol Reserve Within A LToken Vault Can Be Lent Out\\nConsider updating the `lendTo` function to ensure that the protocol reserve is preserved and cannot be lent out. If the underlying asset of a LToken vault is less than or equal to the protocol reserve, the lending should be paused as it is more important to preserve the protocol reserve compared to lending them out.\\n```\\nfunction lendTo(address account, uint amt)\\n    external\\n    whenNotPaused\\n    accountManagerOnly\\n    returns (bool isFirstBorrow)\\n{\\n    updateState();\\n    isFirstBorrow = (borrowsOf[account] == 0);\\n    \\n    require\\n\\n    uint borrowShares;\\n    require((borrowShares = convertAssetToBorrowShares(amt)) != 0, "ZERO_BORROW_SHARES");\\n    totalBorrowShares // Add the line below\\n= borrowShares;\\n    borrowsOf[account] // Add the line below\\n= borrowShares;\\n\\n    borrows // Add the line below\\n= amt;\\n    asset.safeTransfer(account, amt);\\n    \\n// Add the line below\\n   require(asset.balanceOf(address(this)) >= getReserves(), "Not enough liquidity for lending") \\n    \\n    return isFirstBorrow;\\n}\\n```\\n\\nSentiment Team\\nWe removed reserves completely in this PR.\\nLead Senior Watson\\nConfirmed fix.