Description

The setParkingLot function in the ConcreteMultiStrategyVault contract does not check the successfulApproval boolean returned by TokenHelper.attemptForceApprove. If the approval fails, subsequent deposits to the parking lot will revert.

function setParkingLot(address parkingLot_) external onlyOwner {
    // [...]
    bool successfulApproval = TokenHelper.attemptForceApprove(token, parkingLot_, type(uint256).max, false);
    emit ParkingLotUpdated(currentParkingLot, parkingLot_, successfulApproval);

    parkingLot = IParkingLot(parkingLot_); // Update the fee recipient
}

Impact

If the approval fails, the contract still updates parkingLot to the new address. Since the vault requires token approval to deposit into the parking lot, all future parking-lot deposit attempts will fail.

Recommendations

Verify that the approval succeeds.

function setParkingLot(address parkingLot_) external onlyOwner {
    // [...]
    bool successfulApproval = TokenHelper.attemptForceApprove(token, parkingLot_, type(uint256).max, false);
+   require(successfulApproval, "Approve failed");
    // [...]
}

Remediation

This issue has been acknowledged by Blueprint Finance, and a fix was implemented in commit 7b237030↗.