Assessment reports>Cove>Threat Model>mint

Function: mint(uint256 shares, address receiver)

This function wraps the mint function to allow the caller to mint shares without specifying a controller.

Inputs

  • shares

    • Control: Fully controlled by the caller.

    • Constraints: None at this level.

    • Impact: The amount of shares to receive.

  • receiver

    • Control: Fully controlled by the caller.

    • Constraints: None at this level.

    • Impact: The address to receive the shares.

Branches and code coverage

Intended branches

  • Call mint with shares, receiver, and msg.sender as arguments.

Function call analysis

  • this.mint(shares, receiver, msg.sender) -> this._claimDeposit(depositRequest, assets, shares, receiver, controller) -> this._transfer(address(this), receiver, shares) -> this._update(from, to, value) -> ERC20PluginsUpgradeable._update -> ERC20PluginsUpgradeable._updateBalances(address plugin, address from, address to, uint256 amount)

    • What is controllable? shares, receiver, and controller.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? It can reenter the contract while updating balances calling receiver's plug-ins, but this function follows the checks-effects-interactions pattern.

Zellic © 2025Back to top ↑