<!-- canonical: https://0xsimao.com/findings/morpho-vault-v2-submit-verbose-selector-abdicated -->

# `submit()` could be more verbose when a selector has been abdicated

Low/Info · Blackthorn · Curated yield vaults · 13th August, 2025

Finding I-1 of the Morpho Vault V2 security review.

- Protocol: https://morpho.org/
- Report: /reports/morpho-vault-v2
- Codebase: https://github.com/0xsimao/vault-v2/tree/ce661d820fb29307981f75eb42393db1c6e42758
- Source: https://github.com/morpho-org/vault-v2/blob/main/audits/2025-09-15-blackthorn.pdf

---

## Summary

`VaultV2::submit()` overflows [here](https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R304) when the timelock of the selector has been set to `type(uint256).max`, which works as intended but could be more verbose.

## Vulnerability Detail

`VaultV2::abdicateSubmit()` sets the timelock to the maximum, making the `submit()` function overflow to disable function calls with this selector.
```solidity
    function abdicateSubmit(bytes4 selector) external {
        timelocked();
        timelock[selector] = type(uint256).max;
        emit EventsLib.AbdicateSubmit(selector);
    }
```

## Impact

Error handling is not very verbose

## Code Snippet

https://github.com/sherlock-audit/2025-08-morpho-vault-v2-aug-13th/pull/25/files#diff-b9b86210e027003894f79227889d79167f92c0aa2b2a1b0291f4606002e22540R384

## Tool Used

Manual Review

## Recommendation

Add an error message.