Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Function: `withdraw_asset`
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?
1-cf-lpPallet: cf-lpFunction: `request_liquidity_deposit_address`Function: `withdraw_asset`Function: `register_lp_account`Function: `register_liquidity_refund_address`
2-cf-pools3-cf-swapping4-cf-witnesser5-engine
Audit ResultsSummary

Function: withdraw_asset

The withdraw_asset function can be used to withdraw from the available balances of the caller.

The function ensures that safe mode is not enabled and that the user is a liquidity provider. It also validates the destination address where the funds should be withdrawn, ensuring the address can be decoded and that it corresponds to a chain that matches the asset being withdrawn.

If all the above checks pass, the account is debited and a corresponding egress is scheduled by invoking the egress handler, implemented by the cf-ingress-egress pallet.

Finally, an event containing the details of the scheduled egress is deposited.

Zellic © 2024Back to top ↑