Skip to content

Update VaultFreezer.sol #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
luis-immunefi wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update VaultFreezer.sol #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions src/VaultFreezer.sol
View file
Open in desktop

@immunefi-magnus-development immunefi-magnus-development Bot Jul 16, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unrestricted freezeVault Enables Arbitrary Vault Freezing Without Access Control

Description:

TL;DR:
The freezeVault function in the VaultFreezer contract lacks access control, allowing any address to mark any vault as frozen, potentially enabling a denial-of-service in future protocol logic.

In the VaultFreezer contract, the freezeVault function (at src/VaultFreezer.sol:38) can be called by any address because it lacks role-based restrictions. This vulnerability permits arbitrary freezing of vaults, which may lead to operational disruptions if downstream functions enforce the isFrozen flag.

Details

The freezeVault function is defined without any access control checks. Unlike the unfreezeVault function, which is restricted using the onlyRole(FREEZER_ROLE) modifier, freezeVault sets the state variable isFrozen to true for a given vault address without verifying the caller's authorization. The relevant code snippet is as follows:

function freezeVault(address vault) external {
    isFrozen[vault] = true;
    emit VaultFreezed(vault);
}

The absence of a role check means that any externally owned account or contract can freeze any vault. Although the current implementation does not enforce additional behavior based on the isFrozen flag, it is noted in the protocol documentation and code context that this flag may be used downstream to restrict vault operations such as withdrawals, rewards distribution, or administrative changes. This leads to a potential denial-of-service (DoS) situation in the future if the isFrozen flag is utilized to gate critical functionalities.

Impact

If exploited, an attacker could arbitrarily freeze vaults, preventing legitimate operations such as withdrawals, rewards claims, or administrative updates. This vulnerability may lead to a partial or complete denial-of-service against the protocol, resulting in potential lock-up of user funds and disruption of protocol operations, should downstream logic enforce restrictions based on the isFrozen flag.

Mitigation Steps:
Restrict the freezeVault function with an appropriate access control modifier (e.g., onlyRole(FREEZER_ROLE)) to ensure that only authorized addresses can freeze vaults.
-Conduct a thorough review of the downstream logic where the isFrozen flag is used and ensure that its enforcement aligns with the intended protocol security model.

  • png_wireless_6n8x3o

@immunefi-magnus-development immunefi-magnus-development Bot Jul 16, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Freeze state is unenforced, allowing vault operations despite freezing

Description:

TL;DR:
The freeze mechanism implemented via the VaultFreezer contract is ineffective because downstream vault operations do not check the isFrozen state before executing critical functions.

In the VaultFreezer contract, while the unfreezeVault function manages the isFrozen state for vault addresses, there is a lack of validation in the downstream vault logic. This allows operations such as withdrawals, reward claims, or administrative actions to proceed even when a vault is marked as frozen, compromising protocol invariants.

Details

The vulnerability originates from the absence of freeze-state checks in the functions that manage vault operations. Although the VaultFreezer contract includes functions like freezeVault and unfreezeVault which modify the isFrozen mapping and emit events (VaultFreezed and VaultUnfreezed respectively), no subsequent logic in the vault's operations verifies this state. For example, critical functions that process user withdrawals or calculate rewards do not include a condition such as require(!isFrozen[vault], 'Vault is frozen'). As a result, even if a vault is marked as frozen to prevent further operations, the intended safety measure is bypassed since these checks are not enforced in any downstream call logic.

Impact

By allowing operations to proceed on a vault that should be frozen, an attacker or misconfigured system may trigger actions such as unauthorized fund withdrawals, alteration of vault states, or reward distributions. This can lead to direct financial losses, breaches of protocol invariants, and potential protocol corruption.

Mitigation Steps:
Integrate a freeze state check using the isFrozen mapping in all critical vault functions to block operations when a vault is marked as frozen.
-Implement and enforce a condition, such as require(!isFrozen[vault], 'Vault is frozen'), in functions that handle withdrawals, reward distributions, and administrative modifications.
-Perform a thorough audit of the call-graph to ensure that every function intended to be gated by the freeze mechanism correctly validates the vault's state.

  • png_wireless_6n8x3o

Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,7 @@ contract VaultFreezer is AccessControlUpgradeable, IVaultFreezerEvents {
* @notice Freezes a vault.
* @param vault Address of the vault to freeze.
*/
function freezeVault(address vault) external onlyRole(FREEZER_ROLE) {
require(!isFrozen[vault], "VaultFreezer: vault already frozen");

function freezeVault(address vault) external {
isFrozen[vault] = true;

emit VaultFreezed(vault);
Expand Down