Submitted by ustas, also found by okkothejawa, Ada, bin2chen, pwnforce, mert_eren, ktg, 0xRobocop, georgits, gjaldon, and hashminer0725
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/VaultController.sol#L666-L670 
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/VaultController.sol#L448 
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/VaultController.sol#L608 
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/VaultController.sol#L621 
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/VaultController.sol#L634
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/VaultController.sol#L647
Modifier VaultController._verifyCreatorOrOwner does not work. Instead of checking the condition msg.sender is creator OR owner, it makes msg.sender is creator AND owner. This would block access to all created Vaults for creators and the owner (if he did not create them).
Specifically, the following functions in the VaultController are affected:
To check this concept, we can make a truth table for the main condition in the modifier msg.sender != metadata.creator || msg.sender != owner. The table shows that the condition will equal false only in the one case where msg.sender is both creator and owner.
The correct condition should be the following: msg.sender != metadata.creator && msg.sender != owner.
In this case, a revert will only happen when msg.sender is neither a creator nor the owner, as it should be according to the documentation.
You can also use the following test to check; add it to the file test\vault\VaultController.t.sol:
In the tests log (forge test --match-test "testFail__deployVault_creator_is_not_owner" -vvvv), you can see that the call ended with revert NotSubmitterNorOwner(0x000000000000000000000000000000000000000000000000DCbA).
VSCodium, Forge
Change the condition to msg.sender != metadata.creator && msg.sender != owner.
RedVeil (Popcorn) confirmed, but disagreed with severity 
