# SpiritVestingFactory::setTreasury() could be 2 factor, as well as the AccessControl OZ contract used in the codebase Low/Info · 0xSimao · AI revenue sharing · 28th November 2025 Finding I-2 of the Spirit Protocol security review. - Report: /reports/spirit-protocol - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-11-28-spirit-protocol.pdf --- **Description:** [SpiritVestingFactory::setTreasury()](https://github.com/0xPilou/spirit-contracts/blob/main/src/vesting/SpiritVestingFactory.sol#L120-L124) is single factor, so a single mistake can lose treasury access forever, which is responsible for cancelling the treasury in the `SpiritVesting` contract. ```solidity function setTreasury(address newTreasury) external onlyTreasury { // Ensure the new treasury address is not the zero address if (newTreasury == address(0)) revert FORBIDDEN(); treasury = newTreasury; } ``` Additionally, throughout the codebase, `AccessControl` is used, which also doesn't have 2 factor. The `SpiritFactory` is mostly stateless, besides the fact that it is a role in the `RewardsController`, so the ability to set staking pools could be compromised. The `RewardController` relies on roles for upgrades, rewards distributions, so it is also a pain point. **Impact:** Lost roles. **Recommended Mitigation:** Use the [AccessControlDefaultAdminRules](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/extensions/AccessControlDefaultAdminRules.sol) for better role management. --- Related findings: - [Throughout code-base: Homogenize how access control is done.](https://0xsimao.com/findings/maple-finance-iii-homogenize-access-control-done): Maple Finance - [deTokenize() is missing access control, anyone can burn other people's nfts](https://0xsimao.com/findings/metazero-i-tokenize-access-control-burn): MetaZero Omnichain NFTs - [`Treasury.noOfBorrowers` can be set to 0 by looping wei deposit<->withdrawals and DoS withdrawals and reset borrower debt](https://0xsimao.com/findings/autonomint-wei-deposit-withdrawals-debt): Autonomint - [Double spending attack in the Vesting contract](https://0xsimao.com/findings/symmio-staking-and-vesting-double-spending-attack-vesting): Symmio, Staking and Vesting