> For the complete documentation index, see [llms.txt](https://reports.immunefi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://reports.immunefi.com/flare-fassets-or-mainnet-audit-comp/47087-sc-insight-collateraltypesfacet.sol-deprecatecollateraltype-allows-to-break-collateraltypes.so.md). # #47087 \[SC-Insight] CollateralTypesFacet.sol::deprecateCollateralType allows to break CollateralTypes.sol::initialize invariant because it allows to deprecate all token collateral vaults leading to ... **Submitted on Jun 8th 2025 at 20:35:50 UTC by @hunter0xweb3 for** [**Audit Comp | Flare | FAssets**](https://immunefi.com/audit-competition/audit-comp-flare-fassets) * **Report ID:** #47087 * **Report Type:** Smart Contract * **Report severity:** Insight * **Target:** * **Impacts:** ## Description ## Brief/Intro CollateralTypesFacet.sol::deprecateCollateralType allows to break CollateralTypes.sol::initialize invariant because it allows to remove all token collateral vaults leading to all agents to be liquidated ## Vulnerability Details When protocol is initialized it calls contracts/assetManager/library/CollateralTypes.sol::initialize with data parameter.\ \_data parameter should contain at least two tokens \[0]:\ The first one should be a pool collateral token \[1] and the rest \[2] (at least one) vault collateral pools:\ contracts/assetManager/library/CollateralTypes.sol::initialize: ```solidity function initialize( CollateralType.Data[] memory _data ) internal { @>[0] require(_data.length >= 2, "at least two collaterals required"); // initial pool collateral token @>[1] require(_data[0].collateralClass == CollateralType.Class.POOL, "not a pool collateral at 0"); _add(_data[0]); // ... for (uint256 i = 1; i < _data.length; i++) { @>[2] require(_data[i].collateralClass == CollateralType.Class.VAULT, "not a vault collateral"); ``` So the protocol declares valid pool token and at least one collateral vault token for agent vault\ This collateral vault token function is for backing fassets minted\ If current collateral vault token is deprecated and vault doesnt switch vault collateral before token.isValid , then agent vault can be liquidated CollateralTypes.sol::initialize ensures at least one vault collateral is enabled for agent vaults However CollateralTypesFacet.sol::deprecateCollateralType allows to break this invariant allowing to deprecate all vault collateral tokens leaving agent vaults unable to SwitchVaultCollateral and becoming irremediably liquidatable:\ contracts/assetManager/library/CollateralTypes.sol::deprecate:\ ```solidity function deprecate( CollateralType.Class _collateralClass, IERC20 _token, uint256 _invalidationTimeSec ) internal { AssetManagerSettings.Data storage settings = Globals.getSettings(); CollateralTypeInt.Data storage token = CollateralTypes.get(_collateralClass, _token); //... uint256 validUntil = block.timestamp + _invalidationTimeSec; @> token.validUntil = validUntil.toUint64(); emit IAssetManagerEvents.CollateralTypeDeprecated(uint8(_collateralClass), address(_token), validUntil); } ``` This is due to CollateralTypes.sol::deprecate doesnt check that at least another one valid vault collateral token is available before deprecating the token ### Suggestion Keep a global variable in state with current number of available vault collaterals tokens\ Increment this variable each time a new token is added with contracts/assetManager/library/CollateralTypes.sol::add\ Decrement this variable each time a token is deprecated with contracts/assetManager/library/CollateralTypes.sol::deprecate first checking (with this new variable) there is at least another vaul token to SwitchVaultCollateral ## Impact Details If all current collateral vault token are deprecated and vault wont have options to SwitchVaultCollateral and will become irremediably liquidatable ## References ## Proof of Concept ## Proof of Concept AgentVault is created with vault collateral token T\ All vault collateral tokens (including T) are deprecated with CollateralTypes.sol::deprecate\ AgentVault is unable to SwitchVaultCollateral and will be eventually liquidated --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://reports.immunefi.com/flare-fassets-or-mainnet-audit-comp/47087-sc-insight-collateraltypesfacet.sol-deprecatecollateraltype-allows-to-break-collateraltypes.so.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.