Due to lack of the withdrawal function (logic) that allow users to withdraw their funds in the VaultBooster contract, the funds that the users deposited into the VaultBooster contract will be stuck forever
Audit: 2023-08-pooltogether-findings
Severity: HIGH

# Lines of code

https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L171-L176
https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L188


# Vulnerability details

## Impact
Due to lack of the withdrawal function (logic) that allow users to withdraw their funds in the VaultBooster contract, the funds that the users deposited into the VaultBooster contract will be stuck forever.

## Proof of Concept
When a user deposit their funds, the user call the VaultBooster#`deposit()` like this:
https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L171-L176
```solidity
  /// @notice Deposits tokens into this contract. 
  /// @dev Useful because it ensures `accrue` is called before depositing
  /// @param _token The token to deposit
  /// @param _amount The amount to deposit
  function deposit(IERC20 _token, uint256 _amount) external {
    _accrue(_token);
    _token.safeTransferFrom(msg.sender, address(this), _amount);

    emit Deposited(_token, msg.sender, _amount);
  }
```

According to the [NatSpec](https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L39) of the VaultBooster contract, the VaultBooster contract allow **anyone** to liquidate arbitrary tokens for a vault like this:
> /// @notice Allows someone to liquidate arbitrary tokens for a vault and improve the vault's chance of winning

Based on the NatSpec above, the VaultBooster contract is supposed to allow a user (**anyone**) to both depositing funds into the VaultBooster contract and withdrawing funds from the VaultBooster contract if the user want.

At the moment, the VaultBooster#`deposit()` allow a user (**anyone**) to deposit funds into the VaultBooster contract.

However, the VaultBooster#`withdraw()` allow **only owner** to withdraw funds from the VaultBooster contract because of putting the `onlyOwner` modifier on the VaultBooster#`withdraw()` like this:
https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L188
```solidity
  function withdraw(IERC20 _token, uint256 _amount) external onlyOwner { /// @audit
```
And then, within the VaultBooster contract, there is no function (logic) that allow a user (**anyone**) to withdraw funds from the VaultBooster contract.

This lead to that the user's funds deposited via the VaultBooster#`deposit()` will be stuck forever in the VaultBooster contract. Because there is no way for the users (besides the owner) to withdraw funds.

## Tools Used
- Manual review

## Recommended Mitigation Steps
Within the VaultBooster contract, consider adding a withdrawal function (logic) that allow **anyone** to be able to withdraw their funds deposited from the VaultBooster contract.


## Assessed type

Other