Part 2

Summary

There are multiple places where a vault is loaded through the load function which does not check whether the given vault exists. This can be a problem as it can just create an empty vault with the given data.

Occurrences:

• MarketMakingEngineConfigurationBranch::setVaultEngine;

• MarketMakingEngineConfigurationBranch::configureDepositAndRedeemFees

• Vault::updateVaultSwapStrategy

Impact

Wrongly modified vaults and possibly empty vaults created.

Tools Used

Manual Review

Recommendations

In these cases load vaults using the loadExisting function which ensures that there is such a vault at the given id.