Assessment reports>Bracket Fi Escrow>Threat Model>bridgeTokenArb

Function: bridgeTokenArb(address token, address arbEscrow, uint256 amount, uint256 maxGas, uint256 gasPrice)

The function is called by the owner after the break timestamp to bridge tokens to the L2.

Inputs

  • token

    • Control: Fully controlled by the caller.

    • Constraints: No constraints.

    • Impact: Address of the token contract.

  • arbEscrow

    • Control: Fully controlled by the caller.

    • Constraints: No constraints.

    • Impact: Address receiving the funds on the destination.

  • amount

    • Control: Fully controlled by the caller.

    • Constraints: No constraints.

    • Impact: Amount of tokens to transfer.

  • maxGas

    • Control: Fully controlled by the caller.

    • Constraints: No constraints.

    • Impact: Max gas deducted from user’s L2 balance to cover the execution in L2.

  • gasPrice

    • Control: Fully controlled by the caller.

    • Constraints: No constraints.

    • Impact: Gas price for the execution in L2.

Branches and code coverage

Intended branches

  • Increases the allowance of the bridgeRouter contract and starts the bridging of the tokens.

Negative behavior

  • N/A.

Function call analysis

  • SafeERC20.safeIncreaseAllowance(IERC20(token), address(this.bridgeRouter), amount)

    • What is controllable? token and amount.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? If it reverts, the entire transaction would revert — no reentrancy scenario.

  • this.bridgeRouter.outboundTransferCustomRefund(token, msg.sender, arbEscrow, amount, maxGas, gasPrice, bytes(""))

    • What is controllable? token, msg.sender, arbEscrow, amount, maxGas, and gasPrice.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? If it reverts, the entire transaction would revert — no reentrancy scenario.

Zellic © 2024Back to top ↑