Assessment reports>Cega>Threat Models>Function: moveAssetsToProduct(string productName, address vaultAddress, uint256 amount)

Function: moveAssetsToProduct(string productName, address vaultAddress, uint256 amount)

This function moves amount of the asset corresponding to the vault identified by productName to the vault from this contract.

Inputs

  • productName

    • Control: Full.

    • Constraints: String must exist in products mapping.

    • Impact: This is the contract the vault is looked up in to transfer tokens to.

  • vaultAddress

    • Control: Full.

    • Constraints: In the fcnProduct.receiveAssetsFromCegaState external call, the vaultStart of the FCNVaultMetadata struct corresponding to vaultAddress is checked to be greater than zero; that is, the vaultAddress must be an existing vault in the fcnProduct.

    • Impact: This is the address that receives the tokens.

  • amount

    • Control: Full.

    • Constraints: The token balance of this contract must be greater than or equal to the amount value or the approval fails.

    • Impact: This is the amount of token to transfer to the vaultAddress.

Branches and code coverage (including function calls)

Intended branches

  • Assets are properly transferred to the vaultAddress.

Negative behaviour

  • Address productAddress cannot be zero (i.e., productName must be valid).

  • Contract CegaState must have enough funds.

  • Address vaultAddress must be valid, as determined by the fcnProduct in the external call to fcnProduct.receiveAssetsFromCegaState.

Function call analysis

  • moveAssetsToProduct -> receiveAssetsFromCegaState(vaultAddress, amount)

    • What is controllable?: vaultAddress, amount.

    • If return value controllable, how is it used and how can it go wrong?: N/A.

    • What happens if it reverts, reenters, or does other unusual control flow?: Nothing. The function follows the CEI pattern.

Zellic © 2024Back to top ↑