Part 2

**Summary **:

The contract does not prevent direct transfers of assets to the contract address. This allows malicious actors to bypass deposit caps by sending assets directly.

**Vulnerability Details **:

• The contract lacks a fallback or receive function to reject direct transfers.

• Malicious actors could send assets directly to the contract, bypassing the maxDeposit cap and potentially causing overexposure.

**Impact **:

• Medium risk of overexposure due to bypassed deposit caps.

• Potential losses for LPs if the vault becomes overexposed to market risks.

**Tools Used **:

• Manual code review.

• Foundry for testing edge cases.

**Recommendation **:

Add a fallback or receive function that reverts to prevent direct transfers:

receive() external payable {
revert("Direct transfers are not allowed");
}