Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Function: `request_liquidity_deposit_address`
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?
1-cf-lpPallet: cf-lpFunction: `request_liquidity_deposit_address`Function: `withdraw_asset`Function: `register_lp_account`Function: `register_liquidity_refund_address`
2-cf-pools3-cf-swapping4-cf-witnesser5-engine
Audit ResultsSummary

Function: request_liquidity_deposit_address

The request_liquidity_deposit_address function can be used to request a channel (i.e., an address) where the user can deposit assets to have them credited to their account.

The function ensures that safe mode is not enacted, that the user is a liquidity provider, and that it has a registered liquidity refund address.

It then invokes the deposit handler, implemented by the cf-ingress-egress pallet, to get the details of the deposit channel. Finally, an event containing the details of the deposit channel is emitted.

Zellic © 2024Back to top ↑