Assessment reports>Aura Finance>Threat Models>Function: sendFrom(address _from, uint16 _dstChainId, byte[] _toAddress, uint256 _amount, address payable _refundAddress, address _zroPaymentAddress, byte[] _adapterParams)

Function: sendFrom(address _from, uint16 _dstChainId, byte[] _toAddress, uint256 _amount, address payable _refundAddress, address _zroPaymentAddress, byte[] _adapterParams)

Wrapper under ProxyOFT.sendFrom() function. Added whenNotPaused modifier and outflow of currentEpoch is increased by the _amount value. Allows any caller to send to another chain.

Inputs

  • _from

    • Control: Full control.

    • Constraints: If _from != msg.sender, transaction will be reverted inside ProxyOFT._debitFrom.

    • Impact: The receiver of innerToken.

  • _dstChainId

    • Control: Full control.

    • Constraints: If _lzSend.trustedRemoteLookup mapping does not contain _dstChainId, transaction will be reverted.

    • Impact: ID of the destination chain to which the tokens will be transferred.

  • _toAddress

    • Control: Full control.

    • Constraints: No checks.

    • Impact: The address of the receiver of tokens in the _dstChainId network.

  • _amount

    • Control: Full control.

    • Constraints: The _from account should have more or an equal amount of tokens.

    • Impact: The amount of innerToken that will be locked inside this contract and transferred to another chain.

Branches and code coverage (including function calls)

Intended branches

  • The balance of the contract increased by amount value.

  • The balance of the from address decreased by amount value.

Negative behavior

  • from != msg.sender.

  • from does not have enough innerToken.

  • The unknown _dstChainId.

Function call analysis

  • OFTCore._send() -> ProxyOFT._debitFrom(address _from,uint16,bytes memory,uint256 _amount) -> innerToken.safeTransferFrom(_from, address(this), _amount);

    • External/internal? External.

    • Argument control? _from and _amount.

    • Impact Will block the sent tokens inside this contract.

Zellic © 2024Back to top ↑