Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Cove>Threat Model>createNewBasket
GeneralOverview
Findings
Critical (2)
High (3)
Medium (2)
Low (1)
Informational (1)
DiscussionTransparent intent of redeemal might lead to unintended consequencesShares can round down to zeroWeights can pass uncheckedDenial-of-service risk where attackers can disrupt rebalance process with BasketManagerUtils.completeRebalance() functionality
Threat ModelWhat are threat models?AnchoredOracle.solAssetRegistry.sol
BasketManagerUtils.sol_finalizeRebalance_processExternalTrades_processInternalTradescompleteRebalancecreateNewBasketproRataRedeemproposeRebalanceproposeTokenSwap
BasketToken.solCoWSwapAdapter.solCoWSwapClone.solFeeCollector.solManagedWeightStrategy.sol
Audit ResultsAssessment Results

Function: createNewBasket(BasketManagerStorage self, string basketName, string symbol, address baseAsset, uint256 bitFlag, address strategy)

This function allows the creation of new baskets.

Inputs

  • self

    • Control: Fully controlled by the calling function.

    • Constraints: None.

    • Impact: The storage reference.

  • basketName

    • Control: Fully controlled by the calling function.

    • Constraints: None at this level.

    • Impact: The basket's name.

  • symbol

    • Control: Fully controlled by the calling function.

    • Constraints: None.

    • Impact: The symbol of the basket.

  • baseAsset

    • Control: Fully controlled by the calling function.

    • Constraints: Check if the base asset is not the zero address.

    • Impact: The base asset of the basket.

  • bitFlag

    • Control: Fully controlled by the calling function.

    • Constraints: Checked that the bit flag is supported by the strategy registry and that the asset is not paused.

    • Impact: The bit flag for the basket.

  • strategy

    • Control: Fully controlled by the calling function.

    • Constraints: Checked that the strategy is supported by the strategy registry.

    • Impact: The strategy for the basket.

Branches and code coverage

Intended branches

  • Set the base asset index for the basket.

  • Add the basket to the list of basket tokens.

  • Set the basket assets and the basket ID.

  • Set the management fee for the basket.

  • Set the index for the basket assets.

  • Clone the basket-token implementation.

  • Initialize the basket token with the given parameters.

Negative behavior

  • Should not allow baseAsset to be the zero address.

  • Should revert if the maximum number of basket tokens has been reached.

  • Should revert if the basket token already exists.

  • Should revert if the strategy registry does not support the strategy.

  • Should revert if the asset is not enabled.

  • Should revert if the asset list is empty.

Zellic © 2025Back to top ↑