OpenEden Disclosed Report

https://github.com/OpenEdenHQ/openeden.vault.audit/tree/d18288e944df21729b18d430b2afec2da99b6287

Summary

The burnFrom() function reverts when called by on a banned user because it invokes _validateKyc, which blocks banned addresses. However, banned users may still hold TBILL tokens.

This creates a situation where:

• The equivalent USDC must remain locked in the vault to maintain full collateralization.
• Their TBILL tokens cannot be redeemed due to undercollaterization risk, hence a permanent lock of those tokens.
• If the maintainer decides to reclaim the USDC worth of the banned users shares , the vault becomes undercollateralized.

---

Impact

• Perma-locks user funds: Banned users shares can't exit the protocol.

---

soon...