Part 2

Summary

In the current implementation, the Vault.update() function allows the isLive flag of a vault to be set to false, effectively marking it as inactive. However, the claimFees() function in FeeDistributionBranch contract does not check whether the vault is live before allowing users to claim their fees. This oversight can lead to significant risks and inconsistencies within the protocol.

Vulnerability Details

• The updateVaultConfiguration() function internally calls Vault.update():
  This function modifies the vault's settings, including the isLive flag.

When set to false, it indicates that the vault is no longer active and should not process any transactions or claims.

• claimFees(uint128 vaultId):
  This function allows users to claim their share of accumulated fees from a specified vault.

However, it does not verify if the vault is still active (i.e., if isLive is true).

Impact

• Users may be able to claim fees from a vault that has been marked as inactive. This could result in users receiving funds from a vault that is no longer operational, undermining the intended functionality of the isLive flag.

• Allowing claims from inactive vaults could lead to financial discrepancies within the protocol. For example, if a vault is inactive due to a security issue or maintenance, allowing fee claims could exacerbate the situation and lead to further complications.

Tools Used

Manual Review

Recommendations