Triple Vaults can get deployed as Atom Wallets, without handling `atomWalletInitialDepositAmount`

[hats-bug-reporter[bot]]

Github username: @Al-Qa-qa Twitter username: al_qa_qa Submission hash (on-chain): 0xeb7d1766b9cce7be5d3dd0196cbb78e0ef5987e6add73ef7d19326a02df4b8dd Severity: medium

Description: Description\ When users create Atoms where, each Atom is meant to be a sovereign identity with an associated Eth Address.

When they create atom they use URI, and when deploying Atoms, if the person can prove the ownership of the data, we will be the owner of it.

The problem lies in deployAtomWallet(), where there is no check if the ID is an Atom Vault or a Triple Vault.

    function deployAtomWallet(uint256 atomId) external whenNotPaused returns (address) {
        if (atomId == 0 || atomId > count) {
            revert Errors.MultiVault_VaultDoesNotExist();
        }
}

We can see in _createAtom(), we mint some shares to the AtomAddress.

        // deposit atomWalletInitialDepositAmount amount of assets and mint the shares for the atom wallet
        _depositOnVaultCreation(
            id,
            atomWallet, // receiver
            atomConfig.atomWalletInitialDepositAmount
        );

But when creating Triples this fees is not taken from the user, and no shares are minted to the Wallet that will target the Triple Vault ID.

2. Recommendations

Prevent the deployment of the ATOM wallet if the ID is for a Triple Vault not an Atom Vault.

    function deployAtomWallet(uint256 atomId) external whenNotPaused returns (address) {
        if (atomId == 0 || atomId > count) {
            revert Errors.MultiVault_VaultDoesNotExist();
        }

+       require(!isTriple[atomId], "This ID is for a Triple not an ATOM");
        ....
    }

Since the protocol design may choose to support ATOM wallets as Triples, Creation Fees should be taken from them.

[Al-Qa-qa]

The main issue is that AtomWallets can be deployed using TripleVaults ID's. which should be prevented as AtomWallet Creation only creates AtomWallets using atomURI.

[mihailo-maksa]

Duplicate of issue #32.