Arbitrary call with user-controlled target
Veda (BoringVault)'s assessment for RD-F-013 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Same analysis as F012. The ManagerWithMerkleVerification accepts strategist-supplied targetData arrays and passes them through vault.manage(). While the merkle proof restricts which calls are allowed, the calldata is user-provided from strategists. The DecoderAndSanitizer validates calldata shape. A merkle root compromise would allow arbitrary calls. This is design-intentional and audited in A-4 with no critical findings. Yellow for architectural call-pattern complexity.
Sources #
- GitHubManagerWithMerkleVerification.sol — calldata pathManagerWithMerkleVerification.sol — accepts targetData from strategists, validated by merkle proofretrieved 2026-05-17
- Seven Seas A-4 — manage architecture auditedA-4 scope included manage() architecture reviewretrieved 2026-05-17
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →