Rough Misty Hawk - `TokenizedShareManager` can't transfer user is blocked to deposit.

[sherlock-admin4]

Rough Misty Hawk

Medium

TokenizedShareManager can't transfer user is blocked to deposit.

Summary

After user deposits, and protocol blocks user to deposit.
After that, user wants to transfer tokens to other , or other want to transfer his tokens to user.
User didn't claim his shares yet.

Transferring to user or from user is reverted.

    function _update(address from, address to, uint256 value) internal override {
        updateChecks(from, to); // @audit-issue can't transfer when from, to deposit blocked
        if (from != address(0)) {
@>          claimShares(from);
        }
        if (to != address(0)) {
@>          claimShares(to);
        }
        super._update(from, to, value);
    }

When from or to didn't claim, transfer uses _update and it claims their shares.
But above reasons, claim fails and it causes revert for transfer.

Root Cause

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/TokenizedShareManager.sol#L46-L55

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/ShareManager.sol#L180-L182

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/modules/ShareModule.sol#L245

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/queues/DepositQueue.sol#L120-L122

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/queues/DepositQueue.sol#L136

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/ShareManager.sol#L219

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/ShareManager.sol#L227

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/TokenizedShareManager.sol#L38-L40

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/TokenizedShareManager.sol#L46-L55

Here, updateChecks(from, to); checks user is allowed to deposit

        if (flags_.hasWhitelist() && !info.canDeposit) {
            revert NotWhitelisted(to);
        }

But it reverts because user is blocked.
So it causes DoS even though users are allowed to transfer.

Internal Pre-conditions

1. User deposits.
2. User blocked to deposit and he didn't claim yet.
3. User wants to transfer tokens or other transfer tokens to user.
4. User and Other are allowed to transfer token.

External Pre-conditions

.

Attack Path

.

Impact

User can't transfer token even though he is allowed to transfer. (DoS)

PoC

.

Mitigation

Update code bypass deposit checking.