Root + Impact

Description

• The BriVault contract declares two storage variables, stakedAmount and totalAssetsShares, which appear to track user stakes and total shares in the vault. Normally, user staked balances are tracked via stakedAsset[receiver] and total shares are tracked via ERC4626’s totalSupply().

• The problem is that stakedAmount and totalAssetsShares are never updated or used in the code. Since they are declared public, the compiler automatically generates getter functions for them. Any external call to vault.stakedAmount() or vault.totalAssetsShares() will always return 0, giving a misleading view of the vault state.

Risk

Likelihood:

• External systems or users query these public getters assuming they reflect actual staked assets or total shares.

• Future contract logic attempts to rely on these variables for accounting, distributions, or analytics.

Impact:

• External contracts, dashboards, or scripts may report incorrect data, believing the vault has zero staked assets or shares.

• Introducing logic that depends on these unused variables could lead to incorrect payouts, calculations, or vulnerabilities.

Proof of Concept

Explanation:
The variables exist and are public, so Solidity generates automatic getter functions. These getters will always return 0 because the variables are never updated in the contract.

Recommended Mitigation

Remove the unused public variables to prevent misleading external queries and reduce the risk of future misuse.