Skip to content
Request an audit

‹ All findings

submit() could be more verbose when a selector has been abdicated

Low/InfoMorpho Vault V2·Blackthorn · Curated yield vaults · 13th August, 2025CodebaseI-1

ReportSource

Summary

VaultV2::submit() overflows here when the timelock of the selector has been set to type(uint256).max, which works as intended but could be more verbose.

Vulnerability Detail

VaultV2::abdicateSubmit() sets the timelock to the maximum, making the submit() function overflow to disable function calls with this selector.

solidity
    function abdicateSubmit(bytes4 selector) external {
        timelocked();
        timelock[selector] = type(uint256).max;
        emit EventsLib.AbdicateSubmit(selector);
    }

Impact

Error handling is not very verbose

Code Snippet

https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R384

Tool Used

Manual Review

Recommendation

Add an error message.