setTreasury() when called on vaults wrong argument is passed into them, instead of passing _treasury, treasury is passed. So it never allows to change the treasury.
Impact
It can lead to wrong distribution of funds when fee is transferred to treasury, funds maybe sent to wrong address or deprecated treasury
0xnirlin
medium
Treasury can never be changed on vaults even after calling changeTreasury()
Summary
changeTreasury()
in VaultFactory contract is meant to change the treasury on both the vaults of certain epoch ids but it doesn't do so.Vulnerability Detail
Look at the following code:
setTreasury() when called on vaults wrong argument is passed into them, instead of passing _treasury, treasury is passed. So it never allows to change the treasury.
Impact
It can lead to wrong distribution of funds when fee is transferred to treasury, funds maybe sent to wrong address or deprecated treasury
Code Snippet
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/VaultFactoryV2.sol#L228
Tool used
Manual Review
Recommendation
setTreasury(treasury)
on vaultsthis will set right treasury on factory.
setTreasury
on vaultsDuplicate of #435