Vault factory 2

[danoctavian]

No description provided.

[octane-security-app]

Summary by Octane

Adds a vault-factory module with a VaultFactory contract that deploys a timelock, proxied vault, optional flex strategy and withdrawal system, plus an owner-controlled address Registry, three rate providers and an uninitialized transparent proxy.

Changes

• vault-factory/src/VaultFactory.sol (added) - New VaultFactory: createVault deploys timelock, vault proxy from registry logic, optional flex strategy or BaseAssetProvider, withdrawal system, bootstraps and renounces roles.
• vault-factory/src/Registry.sol (added) - New initializable Registry mapping bytes32/string keys to addresses in ERC-7201 storage; setValue/setValues and transferOwnership gated by a custom onlyOwner check.
• vault-factory/src/provider/FlexProvider.sol (added) - New provider returning PAR_RATE for baseAsset/defaultAsset and convertToAssets(1e18) for strategy shares; constructor reverts unless strategy asset and decimals match defaultAsset.
• vault-factory/src/provider/FixedRateProvider.sol (added) - New provider reading ASSET/DECIMALS from an accounting token and returning 10**DECIMALS for that asset or the accounting token, reverting otherwise.
• vault-factory/src/provider/BaseAssetProvider.sol (added) - New provider storing baseAsset, defaultAsset and a constructor-supplied rate; getRate returns that rate for both assets and reverts with UnsupportedAsset otherwise.
• vault-factory/src/proxy/UninitializedTransparentUpgradeableProxy.sol (added) - Extends TransparentUpgradeableProxy with empty constructor data and overrides _unsafeAllowUninitialized() to return true.

Worth a look

• vault-factory/src/VaultFactory.sol - createVault grants ASSET_WITHDRAWER_ROLE to the withdrawer, pulls bootstrapAmount via safeTransferFrom(msg.sender), and renounces factory roles; check ordering and role cleanup.
• vault-factory/src/proxy/UninitializedTransparentUpgradeableProxy.sol - Proxy is deployed with empty init data and overrides _unsafeAllowUninitialized() to true, so the vault proxy is created uninitialized before _initializeVault runs.
• vault-factory/src/Registry.sol - Registry holds the logic addresses the factory deploys from; ownership and setValue/setValues use a hand-rolled onlyOwner with no two-step transfer.
• vault-factory/src/provider/FlexProvider.sol - getRate prices strategy shares via IERC4626.convertToAssets(1e18); the 18-decimal assumption is enforced only in the constructor.

---

🔗 Commit Hash: 8f2fd8b

[octane-security-app]

Overview

Vulnerabilities found:	9

Warnings found:	1

---

🔗 Commit Hash: 8f2fd8b
🛡️ Octane Dashboard: All vulnerabilities