MEDIUM severity: Vault initialization allows deposit whitelist with no management capability. **Description:** The `VaultTokenized` contract can be initialized with deposit whitelist enabled but without any ability to add addresses to the whitelist. This creates a state where deposits are restricted to whitelisted addresses, but no addresses can be whitelisted, effectively blocking all...

Vulnerable code:
// File: VaultTokenized.sol
function _initialize(uint64, /* initialVersion */ address, /* owner */ bytes memory data) internal onlyInitializing {
    VaultStorageStruct storage vs = _vaultStorage();
    (InitParams memory params) = abi.decode(data, (InitParams));
    // [...truncated for brevity...]

    if (params.defaultAdminRoleHolder == address(0)) {
        if (params.depositWhitelistSetRoleHolder == address(0)) {
            if (params.depositWhitelist) {
                if (params.depositorWhitelistRoleHolder == address(0)) {
                    revert Vault__MissingRoles();
                }
            } else if (params.depositorWhitelistRoleHolder != address(0)) {
                revert Vault__InconsistentRoles();
            }
        }
        // [...code...]
    }
    // [...code...]
}

// This demonstrates that when the vault is created with depositWhitelist=true
     // and depositWhitelistSetRoleHolder set but depositorWhitelistRoleHolder NOT set,
     // no deposits can be made until whitelist is turned off, because no one can add
     // addresses to the whitelist.
    function test_WhitelistInconsistency() public {
        // Create a vault with whitelisting enabled but no way to add addresses to the whitelist
        uint64 lastVersion = vaultFactory.lastVersion();

        // configuration:
        // 1. depositWhitelist = true (whitelist is enabled)
        // 2. depositWhitelistSetRoleHolder = alice (someone can toggle whitelist)
        // 3. depositorWhitelistRoleHolder = address(0) (no one can add to whitelist)
        address vaultAddress = vaultFactory.create(
            lastVersion,
            alice,
            abi.encode(
                IVaultTokenized.InitParams({
                    collateral: address(collateral),
                    burner: address(0xdEaD),
                    epochDuration: 7 days,
                    depositWhitelist: true, // Whitelist ENABLED
                    isDepositLimit: false,
                    depositLimit: 0,
                    defaultAdminRoleHolder: address(0), // No default admin
                    depositWhitelistSetRoleHolder: alice, // Alice can toggle whitelist
                    depositorWhitelistRoleHolder: address(0), // No one can add to whitelist
                    isDepositLimitSetRoleHolder: alice,
                    depositLimitSetRoleHolder: alice,
                    name: "Test",
                    symbol: "TEST"
                })
            ),
            address(delegatorFactory),
            address(slasherFactory)
        );

        vault = VaultTokenized(vaultAddress);

        assertEq(vault.depositWhitelist(), true);
        assertEq(vault.hasRole(vault.DEPOSIT_WHITELIST_SET_ROLE(), alice), true);
        assertEq(vault.hasRole(vault.DEPOSITOR_WHITELIST_ROLE(), address(0)), false);
        assertEq(vault.isDepositorWhitelisted(alice), false);
        assertEq(vault.isDepositorWhitelisted(bob), false);

        // Step 1: Try to make a deposit as bob - should fail because whitelist is on
        // and bob is not whitelisted
        collateral.transfer(bob, 100 ether);
        vm.startPrank(bob);
        collateral.approve(address(vault), 100 ether);
        vm.expectRevert(IVaultTokenized.Vault__NotWhitelistedDepositor.selector);
        vault.deposit(bob, 100 ether);
        vm.stopPrank();

        // Step 2: Alice tries to add bob to the whitelist - should fail because
        // she has the role to toggle whitelist but not to add addresses to it
        vm.startPrank(alice);
        vm.expectRevert(); // Access control error (alice doesn't have DEPOSITOR_WHITELIST_ROLE)
        vault.setDepositorWhitelistStatus(bob, true);
        vm.stopPrank();

        // Step 3: Alice tries to turn off whitelist (which she can do)
        vm.startPrank(alice);
        vault.setDepositWhitelist(false);
        vm.stopPrank();

        // Step 4: Now bob should be able to deposit
        vm.startPrank(bob);
        vault.deposit(bob, 100 ether);
        vm.stopPrank();

        // Verify final state
        assertEq(vault.activeBalanceOf(bob), 100 ether);
    }

if (params.defaultAdminRoleHolder == address(0)) {
    if (params.depositWhitelist && params.depositorWhitelistRoleHolder == address(0)) {
        revert Vault__MissingRoles();
    }

    if (!params.depositWhitelist && params.depositorWhitelistRoleHolder != address(0)) {
        revert Vault__InconsistentRoles();
    }
     // [...code...]

}