# #46241 \[SC-Insight] Misleading definition in Core-Vault documentation (“CV operators submit proof”) **Submitted on May 27th 2025 at 07:10:26 UTC by @Paludo0x for** [**Audit Comp | Flare | FAssets**](https://immunefi.com/audit-competition/audit-comp-flare-fassets) * **Report ID:** #46241 * **Report Type:** Smart Contract * **Report severity:** Insight * **Target:** * **Impacts:** ## Description The code restricts confirmReturnFromCoreVault to onlyAgentVaultOwner, yet the docs say Core-Vault operators “CV operators execute the transfer and submit proof of payment to the asset manager.” This is reported here: Operators only generate the FDC proof; the on-chain submission must be performed by the agent (vault owner). Recommend clarifying the docs accordingly. ## Proof of Concept ## Proof of Concept The contract function can only be executed by the agent-vault owner (enforced by onlyAgentVaultOwner). ``` function confirmReturnFromCoreVault(IPayment.Proof calldata _payment, address _agentVault) external onlyAgentVaultOwner(_agentVault) { … } ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://reports.immunefi.com/flare-fassets-or-mainnet-audit-comp/46241-sc-insight-misleading-definition-in-core-vault-documentation-cv-operators-submit-proof.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.