> For the complete documentation index, see [llms.txt](https://docs.ipor.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipor.io/build-on-fusion/atomists/curating-a-fusion-vault/integration-maintenance-and-deprecation.md). # Integration Maintenance and Deprecation ## Purpose and Scope This document outlines critical security best practices for the ongoing maintenance and monitoring of Fuses, Market Substrates, and Balance Fuses within Fusion vaults. It highlights the severe security risks associated with leaving unused or deprecated integrations active and provides actionable guidelines for Atomists and Fuse Managers to minimize attack vectors on existing deployments. ## The Risk of Dormant Integrations In the modular architecture of IPOR Fusion, Fuses and Market Substrates allow vaults to interact directly with external DeFi protocols. While this deep composability is a core strength, it inherently expands the smart contract surface area. A common and highly critical DeFi vulnerability involves the **state manipulation of dormant integrations**. Attackers frequently use flash loans to artificially alter the balances or prices within a deprecated external pool. If a vault still actively queries this legacy pool for its accounting, the attackers can exploit this discrepancy to manipulate the vault's perceived total assets, allowing them to drain significant value from the vault. This underscores a vital DeFi security principle for IPOR Fusion vault operators: **Integrations must be actively maintained, and anything that is no longer in use must be explicitly removed.** ## The Critical Role of Balance Fuses Balance Fuses serve as the accounting layer of IPOR Fusion. They query external protocols to calculate the vault's net position, which directly dictates the vault's `totalAssets()` and, consequently, the share price for all depositors. If a vault maintains a connection to an unused or deprecated Balance Fuse: 1. **Accounting Manipulation:** Attackers can use flash loans to manipulate the state of the external pool. If your vault's Balance Fuse still queries this pool, the vault will register an artificial spike or drop in `totalAssets()`. 2. **Share Price Arbitrage:** A manipulated `totalAssets()` value allows attackers to mint shares at an artificially low price or redeem them at a highly inflated price, draining the underlying assets from legitimate users. For this reason, if a vault is no longer utilizing a specific market, the `ATOMIST_ROLE` or `FUSE_MANAGER_ROLE` **must** ensure the position is fully exited and the corresponding Balance Fuse is immediately removed via `PlasmaVaultGovernance.removeBalanceFuse()`. ## Managing Market Substrates Substrates define the specific assets, pools, or external vault parameters permitted for a given market. Leaving unused substrates granted creates unnecessary risk: * If a whitelisted token or pool experiences a smart contract issue (e.g., an underlying bridge is compromised or a pool is hacked), and the substrate is still active, the vault remains exposed to potential contagion. * Attackers might find ways to route malicious logic through forgotten pools that remain authorized by the vault's configuration. Substrates that are no longer part of the vault's active strategy must be explicitly revoked using `PlasmaVaultGovernance.revokeMarketSubstrate()`. ## Actionable Guidelines for Vault Managers To maintain a robust security posture and minimize the attack surface, vault operators (`ATOMIST_ROLE` and `FUSE_MANAGER_ROLE`) must adhere to the following lifecycle management practices: ### 1. Principle of Least Privilege (Minimal Attack Surface) Only grant the exact substrates and fuses required for the vault's *current* strategy. Do not whitelist assets, grant market IDs, or add operation fuses "just in case" they might be needed in the future. ### 2. Routine Integration Audits Regularly review the `CFG_FUSES_ARRAY`, active balance fuses, and granted market substrates. Cross-reference these with the active strategies being executed by the `ALPHA_ROLE`. If a strategy is paused, abandoned, or migrated, its supporting infrastructure must be dismantled. ### 3. Safe Deprecation of Markets When retiring a market from a vault's strategy, follow this strict sequence to avoid locking funds or leaving vulnerabilities behind: 1. **Exit Positions:** The `ALPHA_ROLE` must execute the `exit()` operations on the relevant operation fuses (e.g., Supply Fuses) to withdraw all assets from the target external protocol, returning the liquidity to the Vault's idle balance. 2. **Remove Operation Fuses:** Call `PlasmaVaultGovernance.removeFuses()` to remove the supply/borrow/swap fuses associated with the retired market. 3. **Verify Dust Threshold:** Ensure the remaining balance in the external protocol is at or below the acceptable dust threshold. 4. **Remove Balance Fuse:** Call `PlasmaVaultGovernance.removeBalanceFuse()` to detach the accounting layer from the deprecated market. *(Note: IPOR Fusion enforces that a balance fuse cannot be removed if it still reports a significant balance to protect user funds).* 5. **Revoke Substrates:** Call `PlasmaVaultGovernance.revokeMarketSubstrate()` to remove the allowed parameters and tokens for that market. ### 4. Monitor the Fuse Whitelist Registry The IPOR DAO maintains a global Fuse Whitelist Registry that tracks the status of all Fuses (`ACTIVE`, `DEPRECATED`, `REMOVED`). Vault managers should actively monitor this registry. If a Fuse used by your vault is marked as `DEPRECATED` or `REMOVED` by the DAO (due to external protocol upgrades or discovered vulnerabilities), you must migrate away from it and remove it from your vault immediately. ## Conclusion Smart contract composability requires active and vigilant maintenance. By ruthlessly pruning unused fuses, outdated balance trackers, and dormant substrates, vault operators can effectively protect user funds and prevent accounting manipulation attacks. A clean, minimal vault configuration is a secure vault configuration.