Skip to content
Request an audit

‹ Findings database

BasicVault::manualRedeem() and BasicVault::manualDeposit() are inconsistent

Low/InfoMitosis audit·Three Sigma·Cross-chain liquidity layer 1·25th June, 20243S-Mitosis-L03

Description

BasicVault::manualDeposit() does not pull assets from the msg.sender, but BasicVault::manualRedeem() burns shares from msg.sender, which is inconsistent. In fact, BasicVault::manualRedeem() is exactly the same as BasicVault::redeem(), the only difference being that the former is permissioned.

Recommendation

The purpose of BasicVault::manualRedeem() is unclear.

Status

Addressed in #07b77cf.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests