`connect()` can be called externally in `AdminStrategy` causing DoS

Impact: Medium

Likelihood: Medium

The connect() function in the AdminStrategy contract is externally callable and lacks access control, which allows any address to call it before the official initialization via AdminOperationalTreasury. Once called, it sets the setUp.treasury field, and any subsequent legitimate call (including the one from init()) will revert due to the TreasuryAlreadySet() check.

    function connect() external override {
        StrategyStorage.SetUp storage setUp = StrategyStorage.layout().setUp;
        IOperationalTreasury treasury_ = IOperationalTreasury(msg.sender);
        if (address(setUp.treasury) != address(0)) revert TreasuryAlreadySet();
        setUp.treasury = treasury_;
    }

This creates a denial-of-service (DoS) vector where an attacker can call connect(), lock in a malicious treasury address, and cause AdminOperationalTreasury initialization to fail irreversibly. This breaks the protocol setup flow and can brick strategy contracts before they are properly initialized.

Note: A similar issue exists in addStrategy, where invoking the strategy's connect function directly prevents admins from successfully adding a new strategy.

Restrict connect() access to only a trusted contract (e.g., via onlyRole or checking msg.sender).

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.