Part 2

Summary

In the vault redemption mechanism of VaultRouterBranch.sol, a critical flaw prevents legitimate users from withdrawing their assets when the vault's isLive status is set to false. Based on the natspec it seems like intended, but this restriction indefinitely locks legitimate user funds.

Vulnerability Details

The function Vault.loadLive(uint128 vaultId) enforces a strict condition that prevents interaction with a vault that is not in a live state:

This implementation ensures that any operation requiring the vault to be live will immediately revert if isLive is set to false. However, this restriction also applies to the intitiateWithdrawal() and redeem() functions, which prevents users from withdrawing their assets once the vault is disabled.

Impact

Temporary or Permanent Asset Locking: Users are unable to withdraw their assets if the vault is disabled, leading to indefinite loss of funds.

Tools Used

Manual review

Recommendations

To mitigate this issue, it is recommended to introduce an emergency withdrawal function that allows legitimate users to withdraw their assets even when isLive == false.