Assessment reports>Cloak V1>Threat Model>deposit

Function: deposit(bytes _to, uint256 _amount, uint256 _keyId)

This function allows a user to deposit ETH to Cloak. It converts ETH to WETH for users and deposits through the contract L1ERC20GatewayValidium.

Inputs

  • _to

    • Control: Fully controlled by the caller.

    • Constraints: N/A.

    • Impact: The encrypted address of the recipient on Cloak.

  • _amount

    • Control: Fully controlled by the caller.

    • Constraints: Must be less than msg.value and must be greater than zero.

    • Impact: The amount of ETH to deposit.

  • _keyId

    • Control: Fully controlled by the caller.

    • Constraints: Must be the latest key ID.

    • Impact: The encryption-key ID of the key used to encrypt the address of the recipient.

Branches and code coverage

Intended branches

  • This function can be successfully executed without reverting.

  • The WETH balance of the gateway increases by _amount.

Negative behavior

  • Reverts if msg.value is less than _amount.

  • Reverts if _amount is zero.

Function call analysis

  • IL1ERC20GatewayValidium(this.gateway).depositERC20{value: msg.value - _amount}(this.WETH, msg.sender, _to, _amount, L1WETHGatewayValidium.GAS_LIMIT, _keyId)

    • What is controllable? msg.value, _amount, _to, and _keyId.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

Zellic © 2025Back to top ↑