# Broken Operator Mechanism: Just 1 malicious / compromised operator can permanently break functionality

Vault operators can add/remove each other and set the alchemist address, so one malicious operator can brick claims, steal auction WETH, and remove all operators permanently.

- Payout: Contest reward
- Severity: medium
- Program: Fair Funding
- Credited: hickuphh3
- Disclosed: 2023-02-03
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-fair-funding-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-fair-funding%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** Vyper Vault contract operator access control
**Root cause:** Operators can freely add/remove other operators and set the alchemist contract address with no higher owner/multisig layer, so a single compromised operator controls the whole role set.
**Steps:**
1. As an operator, call the setter to point `alchemist` to a malicious contract that returns a no-op and arbitrary `shares_issued` from `depositUnderlying()`.
2. Call `register_deposit` so WETH approval is granted to the (now malicious) alchemist contract.
3. Settle the last auction (anyone can settle) to move auction funds.
4. Pull the approved WETH from the vault via the malicious alchemist.
5. Optionally remove all other operators and yourself, leaving zero operators and no remediation path.
**How found:** Code review of the operator access-control structure: noticed operators can add/remove each other and set the alchemist address, and reasoned that a single compromised operator is enough to break the protocol given the WETH approval granted on register_deposit.
**Exploitation:** A single malicious/compromised operator swaps the alchemist for a malicious implementation, triggers register_deposit to grant WETH approval, settles the pending auction, and drains the approved auction funds; alternatively sets a bogus alchemist to permanently brick claiming/liquidation and locks token holders' funds in Alchemix.
**Escalation:** Removing all operators (including self) after bricking the alchemist leaves no operator able to remediate, making the DoS permanent.
**Insight:** When a privileged role can mutate its own membership and point to external contracts that receive token approvals, treat any single member as fully trusted-equal-to-owner; check whether one member can zero out the role set or redirect approvals to attacker code.