QA Report

[code423n4]

few LOW / QA findings:

[QA-01] TransferOwnership has no zero-address check

Notably this also allows to create a contract with locked access:
deployFor
createFor

Results in: emit TransferOwnership(_oldOwner: VaultFactory: [0x037fc82298142374d974839236d2e2df6b5bdd8f], _newOwner: 0x0000000000000000000000000000000000000000)

[LOW-02] Vault.Sol: fallback allows to execute any installed method to be executable

Any methods that gets installed as a plugin can be executed without hash permission as the call directs to the internal function.
This may become dangerous if exposed method was meant to be callable by owner/permissioned module.

[QA-03] deploy/deployFor is callable directly

a direct call to VaultFactory does not make a register VaultRegistry

This may be intended to be deployable directly, but a new deploy will be occured by any msg.sendercaller in that case.

[LOW-04] createInCollection allows passing any token's address, which can be a fake FERC1155 or invalid

As the function expects token to pass a FERC1155, it allows setuping a vault with any token as registry.
An arbitrary token may allow to more attack control for that affected vault.

This may be intended, but it's preferable to not allow user to specify address of a token that is controllable by attacker and can be exploited in Buyout and Migration

[LOW-05] createCollectionFor can setup a token controller with zero address

a controller will not be able to fulfill onlyController checks in a token if controller address was set 0.

[QA-06] deployVault can be deployed with 0 fractionSupply minted