# When one of the plugins is broken or paused, `deposit()` or `withdraw()` of the whole Vault contract can malfunction

Vault deposits route to first plugin and withdrawals from last; a paused Aave V2 plugin blocks all vault deposit/withdraw and plugin removal.

- Payout: Contest reward
- Severity: medium
- Program: Mycelium
- Credited: ctf_sec
- Disclosed: 2022-10-03
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-mycelium-judging/tree/main/006-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-mycelium%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault.sol plugin routing (deposit/withdraw/rebalance)
**Root cause:** Deposits always go to the first plugin and withdrawals drain the last plugin first, with no per-plugin pause handling; a paused Aave V2 lending pool reverts deposit/withdraw, and plugin removal/rebalance depend on those same calls.
**Steps:**
1. Aave V2 LendingPool is paused (whenNotPaused modifier reverts deposit/withdraw).
2. Vault.deposit() routes funds to the first plugin (Aave V2 plugin) -> reverts.
3. Vault.withdraw() pulls from the last plugin first, cascading into the paused plugin -> reverts.
4. Owner cannot removePlugin or rebalance because both require withdrawing from the plugin.
**How found:** Code reading of Vault deposit/withdraw ordering (first-plugin deposit, last-plugin withdraw) combined with knowledge that Aave V2 core functions carry whenNotPaused, showing a single external pause bricks the whole vault.
**Insight:** When a vault fans funds across external yield plugins, check whether any single plugin's revert (pause, cap, migration) can block the aggregate deposit/withdraw path and the admin escape hatches (removePlugin/rebalance) that also route through it.