MEDIUM severity: Vault initialization allows zero deposit limit with no ability to modify causing denial of service. **Description:** The `VaultTokenized` contract's initialization procedure allows a vault to be created with deposit limit feature enabled at a value of zero, but without any ability to change this limit. This creates a state where all deposits are effectively blocked, as the limit is set to zero,...

Vulnerable code:
// File: VaultTokenized.sol
function _initialize(uint64, /* initialVersion */ address, /* owner */ bytes memory data) internal onlyInitializing {
    VaultStorageStruct storage vs = _vaultStorage();
    (InitParams memory params) = abi.decode(data, (InitParams));
    // [...code...]

    if (params.defaultAdminRoleHolder == address(0)) {
        // [...code...]

        if (params.isDepositLimitSetRoleHolder == address(0)) { //@audit check only happens when deposit limit set holder is zero address
            if (params.isDepositLimit) {
                if (params.depositLimit == 0 && params.depositLimitSetRoleHolder == address(0)) {
                    revert Vault__MissingRoles();
                }
            } else if (params.depositLimit != 0 || params.depositLimitSetRoleHolder != address(0)) {
                revert Vault__InconsistentRoles();
            }
        }
    }
    // [...code...]
}

// This demonstrates that when the vault is created with isDepositLimitSetRoleHolder
    // set but depositLimitSetRoleHolder NOT set,
    // deposit limit is enabled but no one can set the limit.
    function test_DepositLimitInconsistency() public {
        // Create a vault with deposit limit enabled but no way to change the limit
        uint64 lastVersion = vaultFactory.lastVersion();

        // configuration:
        // 1. isDepositLimit = true (deposit limit is enabled)
        // 2. depositLimit = 0 (zero limit)
        // 3. isDepositLimitSetRoleHolder = alice (alice can toggle the feature)
        // 4. depositLimitSetRoleHolder = address(0) (no one can set the limit)
        address vaultAddress = vaultFactory.create(
            lastVersion,
            alice,
            abi.encode(
                IVaultTokenized.InitParams({
                    collateral: address(collateral),
                    burner: address(0xdEaD),
                    epochDuration: 7 days,
                    depositWhitelist: false,
                    isDepositLimit: true, // Deposit limit ENABLED
                    depositLimit: 0, // Zero limit
                    defaultAdminRoleHolder: address(0), // No default admin
                    depositWhitelistSetRoleHolder: alice,
                    depositorWhitelistRoleHolder: alice,
                    isDepositLimitSetRoleHolder: alice, // Alice can toggle limit feature
                    depositLimitSetRoleHolder: address(0), // No one can set the limit
                    name: "Test",
                    symbol: "TEST"
                })
            ),
            address(delegatorFactory),
            address(slasherFactory)
        );

        vault = VaultTokenized(vaultAddress);

        // Verify initial state
        assertEq(vault.isDepositLimit(), true);
        assertEq(vault.depositLimit(), 0);
        assertEq(vault.hasRole(vault.IS_DEPOSIT_LIMIT_SET_ROLE(), alice), true);
        assertEq(vault.hasRole(vault.DEPOSIT_LIMIT_SET_ROLE(), address(0)), false);

        // Step 1: Try to make a deposit - should fail because limit is 0
        collateral.transfer(bob, 100 ether);
        vm.startPrank(bob);
        collateral.approve(address(vault), 100 ether);
        vm.expectRevert(IVaultTokenized.Vault__DepositLimitReached.selector);
        vault.deposit(bob, 100 ether);
        vm.stopPrank();

        // Step 2: Alice tries to set a deposit limit - should fail because
        // she can toggle the feature but not set the limit
        vm.startPrank(alice);
        vm.expectRevert(); // Access control error
        vault.setDepositLimit(1000 ether);
        vm.stopPrank();

        // Step 3: Alice turns off the deposit limit feature
        vm.startPrank(alice);
        vault.setIsDepositLimit(false);
        vm.stopPrank();

        // Step 4: Now bob should be able to deposit
        vm.startPrank(bob);
        vault.deposit(bob, 100 ether);
        vm.stopPrank();

        // Verify final state
        assertEq(vault.activeBalanceOf(bob), 100 ether);
    }

if (params.defaultAdminRoleHolder == address(0)) {
    // [...whitelist code...]

    if (params.isDepositLimit && params.depositLimit == 0 && params.depositLimitSetRoleHolder == address(0)) {
        revert Vault__MissingRoles();
    }

    if (!params.isDepositLimit && (params.depositLimit != 0 || params.depositLimitSetRoleHolder != address(0))) {
        revert Vault__InconsistentRoles();
    }
}