Summary
The vault and slashers in scope of the protocol in OpNetVaultAutoDeploy are BASE_VAULT_VERSION and TOKENIZED_VAULT_VERSION, SlasherType.INSTANT and SlasherType.VETO.
The issue is that the epoch duration can not be updated in these contracts, they always use the same value. As a result, whenever it is changed in the epoch manager via EpochManager::setEpochDuration(), it will completely ruin the vault's staking and slashing mechanism, as they rely on the epoch duration. For example, the instant slasher requires the slashing to be within 1 epoch duration, but if the epoch duration is now bigger/smaller, slashing will fail for a significant period of time. Slashing also has several checks which don't allow slashing whenever the operator, token or vault is not registered in that epoch, which can make slashing impossible via slashVault() in case of epoch duration change.
Additionally, the slashing window must be bigger than the epoch duration, but the slasher's and vault's epoch duration can't be changed, so this will also not work properly. The same happens for the veto duration of the veto slasher.
Vault::onSlash() requires the epoch to be no older than currentEpoch_ - 1, but a different duration means this will fail. For example, if the duration is halved, calling at duration / 2 + 1 after the current epoch will revert as this is already 2 epochs in the past.
Root Cause
In EpochManager:115, setting a new epoch duration will always break the vault and their slasher.
Internal Pre-conditions
None
External Pre-conditions
None
Attack Path
EpochManager::setEpochDuration()is called.
Impact
Epoch duration is out of sync between the vaults, slashers and the epoch manager, so slashing will fail or be impossible.
Mitigation
Non trivial.