# In GReservePool, if a strategy is frozen reserve pool stops working Crit/High · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-M03 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description If a strategy stops working it will become impossible to use the Reserve Pool. The functions deposit(), [withdraw()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/GlacialAVAX/glAVAX.sol#L252) and withdrawAll() will no longer work. This problem will also affect the contract glAVAX which will make the functions rebalance() and withdraw() not work as those functions can call the broken functions of the Reserve Pool. There is the possibility of the third party application that is being used by the strategy to stop working. Which will leave the funds in the third party application, making you wait for it to recover, and in the meantime the code will revert. ### Recommendation It would be best in this scenario to remove strategies from the reserve pool (keeping them from reverting), this would be possible using the rebalance() function suggested in 3S-GLACIER-L03 and the fact that applications,like aave, allow for withdrawals if it is frozen. For this we would add a removeBrokenStrategy() that would call a function in the strategy to try and withdraw the funds, and would remove the strategy from the list. In the strategy a new function called handleBroken() would try to withdraw the funds so they can be distrib uted among the other strategies (this function would be tailored to what protocol is being used). A function would also need to be added to return the broken strategy back into the reserve pool. ### Status This issue has been addressed in commit: [#56e95e1](https://github.com/threesigmaxyz/glacier-contracts-foundry/commit/56e95e1b7bdabab8c13fdaf736a5b9d479f5766f). --- Related findings: - [AaveYieldBackend.deposit() DoS when Aave pool is paused, frozen, or at supply cap](https://0xsimao.com/findings/superfluid-aave-yield-deposit-paused): Superfluid Yield Backends - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires): Cork Protocol - [Withdrawals in the Maple Pool and Sky Strategy may be DoSed in case the DssLitePsm halts buying](https://0xsimao.com/findings/maple-finance-iv-withdrawals-dss-lite-halts): Maple Cash Strategies - [`Strategy::checkPoolActivity()` incorrect check leads to vulnerable price](https://0xsimao.com/findings/yieldoor-activity-incorrect-vulnerable-price): Yieldoor