# Vault implementation can be destroyed leading to loss of all assets

Uninitialized Vault implementation behind proxies could be initialized by anyone, then selfdestructed via execute, bricking all vaults and locking all assets permanently.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: 0xA5DF
- Disclosed: 2022-09-27
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/200
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:misconfiguration

**Target:** VaultFactory/Vault proxy implementation (Solidity)
**Root cause:** VaultFactory deploys a single Vault implementation without calling init(), leaving ownership claimable by anyone; proxies delegate to it and have no upgrade path.
**Steps:**
1. Deploy registry, supply, baseVault; read registryVaultFactory.implementation() to get implVaultAddress
2. Attacker calls `vaultImpl.init()` to become owner
3. Attacker calls `vaultImpl.setMerkleRoot(leafHash)` where leaf encodes attacker, Destructor address, and destruct selector
4. Attacker calls `vaultImpl.execute(destructor, destructData, [])` triggering `selfdestruct` on the implementation
5. Implementation code size becomes 0; all proxy vaults revert on any call (e.g. `owner()`) permanently
**How found:** Code reading of VaultFactory/Vault: noticed the implementation is deployed but never initialized, and that Vault exposes init() plus an execute() capable of delegatecall to arbitrary code including selfdestruct.
**Exploitation:** Attacker needs no capital: just gas. Initialize the shared implementation, register a merkle leaf pointing to a Destructor contract exposing `destruct(address)`, then invoke execute to delegatecall selfdestruct, wiping the implementation code that every proxy depends on.
**Escalation:** Single implementation shared by all vaults means one selfdestruct bricks every vault and locks all deposited assets; no upgrade mechanism exists to recover.
**Insight:** For proxy/factory patterns, always check whether the shared implementation is initialized in its constructor; an uninitialized impl with an arbitrary-call/execute function is a selfdestruct primitive that bricks every proxy at once.