# Weak Address Salt in VaultFactory::createVault Enables DoS and Hijacking of the Curator +Allocator Roles

VaultFactory.createVault salts vault addresses only on admin/asset/name/symbol/salt, so front-running with altered curator/timelock/fees blocks or hijacks legitimate vault creation.

- Payout: Contest reward
- Severity: medium
- Program: Term Structure
- Credited: silverologist
- Disclosed: 2025-03-20
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_structure_february2025.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.2
- Tags: domain:web3 impact:dos impact:privesc kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:race-window vuln:access-control vuln:business-logic vuln:dos

**Target:** VaultFactory.createVault (Solidity smart contract)
**Root cause:** The CREATE2 salt omits curator, timelock, maxCapacity and performanceFeeRate, so two calls with different privileged params derive the same vault address; createVault is also permissionless.
**Steps:**
1. Deploy OrderManager, TermMaxVault implementation, VaultFactory.
2. Build VaultInitialParams(deployer, curator, timelock, token, maxCapacity, "Vault-DAI", "Vault-DAI", fee).
3. Attacker calls `vaultFactory.createVault(initialParams, 0)` first, occupying the deterministic address.
4. Victim calls `createVault` with modified curator/timelock/maxCapacity/fee but same salt inputs; reverts with `FailedDeployment()`.
5. Repeat front-run on every legitimate creation to DoS, or let victim use the address to hijack curator/allocator roles.
**How found:** Noticed createVault lacks access control and that the address salt excludes initialParams fields (curator, timelock, maxCapacity, performanceFeeRate), implying identical addresses for differing privileged configs; confirmed with a Foundry PoC.
**Exploitation:** Attacker watches mempool for createVault, front-runs with same admin/asset/name/symbol/salt but attacker-chosen curator/timelock/maxCapacity/performanceFeeRate, taking the deterministic address; victim's tx reverts, yielding either persistent DoS or attacker-controlled privileged roles if victim proceeds.
**Insight:** When auditing CREATE2 factories, diff the salt inputs against the full init/config struct: any privileged parameter not hashed into the salt lets a front-runner occupy the address with attacker-chosen roles.