Part 2

Summary

In the current implementation, admins can pause a vault using the isLive flag. However, even when a vault is paused, it continues to receive debt allocations, despite not allowing new deposits. This can lead to unintended accumulation of bad debt.

Vulnerability Details

• When a vault is marked as not live (isLive = false), it prevents new deposits and redemptions.

• However, the protocol still distributes debt to this inactive vault during recalculateVaultsCreditCapacity.

• Since the vault cannot receive new deposits, it has no way to balance or repay the allocated debt, leading to bad debt accumulation.

Impact

• Unrecoverable bad debt – The vault will accumulate debt it cannot repay.

• Risk of insolvency – Markets relying on paused vaults may experience imbalances.

• Inefficient debt distribution – Debt should only be assigned to active vaults to ensure smooth operations.

Tools Used

Manual review

Recommendations

Modify the recalculateVaultsCreditCapacity function to exclude paused vaults (isLive = false) when distributing debt.