Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Function: `register_liquidity_refund_address`
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?
1-cf-lpPallet: cf-lpFunction: `request_liquidity_deposit_address`Function: `withdraw_asset`Function: `register_lp_account`Function: `register_liquidity_refund_address`
2-cf-pools3-cf-swapping4-cf-witnesser5-engine
Audit ResultsSummary

Function: register_liquidity_refund_address

The register_liquidity_refund_address function can be used to register a liquidity refund address.

The function checks that the caller is a registered liquidity provider and that the provided refund address can be validly decoded.

It then inserts the address in the LiquidityRefundAddress double map, and it deposits an event that contains the details of the operation.

Note that refund addresses are associated to a tuple of account ID and chain ID; therefore, an account can have multiple refunds addresses associated with it (up to one per supported chain).

Zellic © 2024Back to top ↑