Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Astroport Pair XYK Sale Tax>Threat Model>Message: Cw20HookMsg::WithdrawLiquidity
GeneralOverview
Threat ModelWhat are threat models?
messagesMessage: ExecuteMsg::ProvideLiquidityMessage: ExecuteMsg::SwapMessage: ExecuteMsg::UpdateConfigMessage: Cw20HookMsg::WithdrawLiquidityReply handler
Audit ResultsSummary

Message: Cw20HookMsg::WithdrawLiquidity

This message can only be sent by the LP token contract associated with the pool.

The parameters that a user can control are:

  • assets — This is a list of pool assets. However, this needs to be empty as imbalanced withdraw is not implemented.

  • amount — This is the amount of LP tokens to burn, in order to receive the share of the pool assets.

  • sender — This is address that receives the pool assets. It's fixed to initiator of the LP token contract call.

The handler for this message computes the share ratio based on the amount of LP tokens to burn, and sends the pool assets share to the sender. It updates the pool balances and the cumulative prices, and returns the response including the messages and attributes.

Zellic © 2024Back to top ↑