# `MetavaultsRegistry::removeBridgePathByIndex()` is missing Low/Info · Sherlock · Yield-tokenisation vaults · 16th December 2025 Finding L-4 of the Spectra MetaVault Bridge security review. - Protocol: https://www.spectra.finance/ - Report: /reports/spectra-metavault-bridge - Source: https://github.com/0xsimao/audits/blob/main/Sherlock/private-audits/2025-12-16-spectra-metavault.pdf --- ## Summary `MetavaultsRegistry::removeBridgePathByIndex()` doesn't exist, which could cause DoS. ## Vulnerability Detail All other functions to remove data have a "by index" counterpart, but `MetavaultsRegistry::removeBridgePath()` doesn't. ## Impact Possible DoS. ## Code Snippet https://github.com/sherlock-audit/2025-12-spectra-metavault-update-dec-16th/pull/2/files#diff-d6dbd850708b46c46f64d8bc2d13e4fe2de6f7ac75f0981bf638274c7830a293R296 ## Tool Used Manual Review ## Recommendation Add the "by index" equivalent. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Adapters could store the index instead of true in the `VaultV2` to remove the O(n) search](https://0xsimao.com/findings/morpho-vault-v2-adapters-store-index-search): Morpho Vault V2 - [OstiumLinkUpKeep:topUp() is missing a length check for registryAddresses](https://0xsimao.com/findings/ostium-link-top-registry-addresses): Ostium - [OstiumTrading::topUpCollateral() is missing pairsStored.groupMaxCollateral(pairIndex) check](https://0xsimao.com/findings/ostium-collateral-pairs-stored-index): Ostium