Description

Neither Voyage or the Vault contract can deploy a subvault, making any functionality currently implemented by the SubVault informational to the current design.

Impact

Currently there is no impact.

However, if the SubVault were to be integrated into Voyage, it would likely cause severe issues.

For example, anyone is able to call pause(...) and unpause(...) on the vault and hence render it inoperable as they please.

Recommendations

Please clarify the intended purpose of the SubVault. If it is not to be integrated into Voyage, we suggest removing it from the code base.

If the intention is to include the SubVault in Voyage, we can then evaluate the current implementation against this intention.

Remediation

Commit d15ae96d↗ was indicated as containing the remediation. The commit fixes the issue by entirely removing all code related to subvaults.