Skip to content
Request an audit

‹ All findings

Possible mistake in the unregister by index functions

Low/InfoSpectra MetaVault Bridge·Sherlock·Yield-tokenisation vaults·16th December 2025·by 0xSimaoL-2

Summary

MetavaultsRegistry::unregisterMarketByIndex() don't check that the index matches the expected market, which may lead to issues if called twice in a row.

Vulnerability Detail

As MetavaultsRegistry::unregisterMarketByIndex() doesn't check the market, if 2 calls are made consecutively, they may arrive at the blockchain in different order, and remove the wrong markets (array popping changes order).

Impact

Code Snippet

https://github.com/sherlock-audit/2025-12-spectra-metavault-update-dec-16th/pull/2/files#diff-d6dbd850708b46c46f64d8bc2d13e4fe2de6f7ac75f0981bf638274c7830a293R187

Tool Used

Manual Review

Recommendation

Send the expected market as argument to verify.