Assessment reports>Aura Finance>Threat Models>Function: addPool(address _gauge, uint256 _stashVersion)

Function: addPool(address _gauge, uint256 _stashVersion)

Adds a gauge to the pool using the provided stash version.

Inputs

  • _gauge

    • Control: Arbitrary.

    • Constraints: The gauge address, nor its associated LP token, cannot already be registered in the booster. If protectAddPool is enabled, the function can only be called by the operator. The default is for this protection to be enabled.

    • Impact: Decides the address of the gauge and picks the LP token to add.

  • _stashVersion

    • Control: Arbitrary.

    • Constraints: Is supposed to be 1, 2, or 3. Otherwise, StashFactoryV2->CreateStash will return address(0) or revert. The given version must have a valid implementation registered in the stash factory.

    • Impact: Decides which stash implementation to use.

Branches and code coverage (including function calls)

Negative behavior

  • Try to add pool as normal user when protectAddPool is disabled.

  • Add pool as normal user when protectAddPool is disabled.

  • Add pool when the everything is shut down.

Function call analysis

  • rootFunction -> IPools(booster).addPool(lptoken, _gauge, _stashVersion)

    • What is controllable? Everything, provided gauge is controlled by caller. There is no gauge whitelisting.

    • If return value controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters, or does other unusual control flow? Return value is not checked.

Zellic © 2024Back to top ↑