Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Cove>Threat Model>proposeRebalance
GeneralOverview
Findings
Critical (2)
High (3)
Medium (2)
Low (1)
Informational (1)
DiscussionTransparent intent of redeemal might lead to unintended consequencesShares can round down to zeroWeights can pass uncheckedDenial-of-service risk where attackers can disrupt rebalance process with BasketManagerUtils.completeRebalance() functionality
Threat ModelWhat are threat models?AnchoredOracle.solAssetRegistry.sol
BasketManagerUtils.sol_finalizeRebalance_processExternalTrades_processInternalTradescompleteRebalancecreateNewBasketproRataRedeemproposeRebalanceproposeTokenSwap
BasketToken.solCoWSwapAdapter.solCoWSwapClone.solFeeCollector.solManagedWeightStrategy.sol
Audit ResultsAssessment Results

Function: proposeRebalance(BasketManagerStorage self, address[] baskets)

This function allows proposing a rebalance for the given baskets.

Inputs

  • self

    • Control: Fully controlled by the calling function.

    • Constraints: None.

    • Impact: The storage reference.

  • baskets

    • Control: Fully controlled by the calling function.

    • Constraints: None at this level.

    • Impact: The baskets that are to be rebalanced.

Branches and code coverage

Intended branches

  • Set the shouldRebalance flag to true if the pendingDeposits are greater than zero.

  • Assume that all baskets within the baskets array are to maintain the same shouldRebalance flag. Alternatively, remove the baskets that do not actually require rebalancing from the proposal.

  • Set the basket mask to the bit mask of the baskets.

  • Set the timestamp to the current block timestamp.

  • Set the rebalance status to REBALANCE_PROPOSED.

  • Calculate the basket value and notify the basket token of the rebalance.

  • Set the shouldRebalance flag to true if the pending deposits are greater than zero.

  • Store the pending redeem value in storage.

  • Determine whether rebalance is required and set the shouldRebalance flag accordingly. Revert otherwise.

  • Update the basket hash with the array of baskets that need rebalancing and their target weights.

Negative behavior

  • Should revert if rebalance is not required. If not all shouldRebalance flags are set to true, the function should revert.

  • Should not allow proposing a rebalance if the status is not NOT_STARTED.

  • Should not allow proposing a rebalance if the time since the last action is less than _REBALANCE_COOLDOWN_SEC.

  • Should not allow proposing a rebalance if the basket does not have any assets.

  • Should not allow proposing a rebalance if the basket has paused assets.

Zellic © 2025Back to top ↑