Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Concrete>Low findings>The VaultManager contract lacks the code to call the function ,emergencyRemoveStrategy
GeneralOverview
Findings
High (2)
Medium (6)
Low (8)The VaultManager contract lacks the code to call the function emergencyRemoveStrategyIncorrect transfer amount in the function rescueFundsThe function redeem lacks dust-amount checkInconsistent handling of infinite allowance in _withdrawLack of support for the 0.01% fee tier for swaps in MorphoVaultStrategyFunction getAvailableAssetsForWithdrawal should return zero when withdrawEnabled is falseFunction changeAllocations does not check vaultIdle status before redistributing assetsIncorrect rounding direction in previewMint
Informational (9)
DiscussionThe ConcreteOracle.getAssetPrice should ensure the returned price uses eight decimalsUnused _decimals variable in strategiesTest suite
DesignComponent: ControllerComponent: ConcreteMultiStrategyVaultComponent: WithdrawalComponent: Strategies
Audit ResultsAssessment Results
Category: Coding Mistakes

The VaultManager contract lacks the code to call the function emergencyRemoveStrategy

Low Impact
Low Severity
N/A Likelihood

Description

The function emergencyRemoveStrategy can only be invoked by the owner of the ConcreteMultiStrategyVault contract. However, the owner — the VaultManager contract — does not implement code to call this function.

function emergencyRemoveStrategy(uint256 index_, bool forceEject_) external onlyOwner

Impact

This function cannot be invoked unless the VaultManager contract is upgraded to include the logic for managing it or the ownership of the ConcreteMultiStrategyVault is transferred to an account capable of invoking it.

Recommendations

Add the function emergencyRemoveStrategy to the VaultManager contract to call the function emergencyRemoveStrategy of the ConcreteMultiStrategyVault.

Remediation

This issue has been acknowledged by Blueprint Finance, and a fix was implemented in commit 64361970↗.

Zellic © 2025Back to top ↑