governor can permanently prevent withdrawals in spite of being restricted
Quoting from the Contest README:\\n```\\nIs the admin/owner of the protocol/contracts TRUSTED or RESTRICTED?\\n\\nRestricted. The governor address should not be able to steal funds or prevent users from withdrawing. It does have access to the govern methods in Factory, and it could trigger liquidations by increasing nSigma. We consider this an acceptable risk, and the governor itself will have a timelock.\\n```\\n\\nThe mechanism by which users are ensured that they can withdraw their funds is the interest rate which increases with utilization.\\nMarket forces will keep the utilization in balance such that when users want to withdraw their funds from the `Lender` contracts, the interest rate increases and Borrowers pay back their loans (or get liquidated).\\nWhat the `governor` is allowed to do is to set a interest rate model via the `Factory.governMarketConfig` function.\\nThis clearly shows that the `governor` should be very much restricted in setting the `RateModel` such as to not damage users of the protocol which is in line with how the `governor` role is described in the README.\\nHowever the interest rate can be set to zero even if the utilization is very high. If Borrowers can borrow funds for a zero interest rate, they will never pay back their loans. This means that users in the Lenders will never be able to withdraw their funds.\\nIt is also noteworthy that the timelock that the governor uses won't be able to prevent this scenario since even if users withdraw their funds as quickly as possible, there will probably not be enough time / availability of funds for everyone to withdraw in time (assuming a realistic timelock length).
The `SafeRateLib` should ensure that as the utilization approaches `1e18` (100%), the interest rate cannot be below a certain minimum value.\\nThis ensures that even if the `governor` behaves maliciously or uses a broken `RateModel`, Borrowers will never borrow all funds without paying them back.
The `governor` is able to permanently prevent withdrawals from the Lenders which it should not be able to do according to the contest README.
```\\nIs the admin/owner of the protocol/contracts TRUSTED or RESTRICTED?\\n\\nRestricted. The governor address should not be able to steal funds or prevent users from withdrawing. It does have access to the govern methods in Factory, and it could trigger liquidations by increasing nSigma. We consider this an acceptable risk, and the governor itself will have a timelock.\\n```\\n