Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Function: request_swap_deposit_address
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?1-cf-lp2-cf-pools
3-cf-swappingPallet: cf-swappingFunction: request_swap_deposit_addressFunction: withdrawFunction: schedule_swap_from_contractFunction: ccm_depositFunction: register_as_brokerFunction: set_minimum_swap_amount
4-cf-witnesser5-engine
Audit ResultsSummary

Function: request_swap_deposit_address

The function allows a broker — a role that anyone can register for — to obtain an address to which deposits trigger an action (a swap or a CCM). The broker may configure the action that the cf-swapping pallet should take upon receiving a deposit to the address.

First, deposits must be enabled in SafeMode. Also, the destination address must be on the same chain as the destination asset and the address must be valid.

If channel_metadata is set, the action is a CCM. These may only be sent if Ethereum is the destination chain.

Zellic © 2024Back to top ↑