Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>d3-doma>Threat Model>Function: detokenizeUnchecked(string calldata tokenId, bool isSynthetic, string calldata correlationId)
GeneralOverview
Findings
Critical (3)
Medium (1)
Low (6)
Informational (2)
Threat ModelWhat are threat models?DomaForwarder.solDomaRecordProxyFacet.solDomaRecordRegistrarClaimFacet.solDomaRecordRegistrarFacet.solERC7786GatewayReceiver.solERC7786GatewaySource.solMarketplace.solOwnershipToken.sol
ProxyDomaRecord.solFunction: bridge(uint256 tokenId, bool isSynthetic, string calldata targetChainId, string calldata targetOwnerAddress)Function: changeLockStatus(string calldata tokenId, bool isSynthetic, bool isTransferLocked, string calldata correlationId)Function: claimOwnership(uint256 tokenId, bool isSynthetic, ProofOfContactsVoucher calldata proofOfContactsVoucher, bytes calldata signature)Function: detokenize(string calldata tokenId, bool isSynthetic, string calldata claimedBy, string calldata correlationId)Function: detokenizeUnchecked(string calldata tokenId, bool isSynthetic, string calldata correlationId)Function: mintOwnershipTokens(uint256 registrarIanaId, OwnershipTokenInfo[] calldata tokens, string calldata ownerAddress, string calldata correlationId)Function: renew(string calldata tokenId, bool isSynthetic, uint256 expiresAt, string calldata correlationId)Function: requestDetokenization(uint256 tokenId, bool isSynthetic)Function: requestTokenization(TokenizationVoucher calldata voucher, bytes calldata signature)Function: tokenTransfer(uint256 tokenId, address from, address to)
Audit ResultsAssessment Results

Function: detokenizeUnchecked(string calldata tokenId, bool isSynthetic, string calldata correlationId)

This function detokenizes domain names without ownership verification. It can only be called by authorized cross-chain senders from Doma chain. It bypasses ownership checks for administrative or emergency detokenization scenarios.

Inputs

  • tokenId

    • Control: Full.

    • Constraints: Converted to uint256 via Strings.parseUint().

    • Impact: Identifies the specific token to detokenize without ownership verification.

  • isSynthetic

    • Control: Not controlled.

    • Constraints: Must be false (synthetic tokens not implemented).

    • Impact: Distinguishes between regular and permissioned tokens.

  • correlationId

    • Control: Full.

    • Constraints: N/A.

    • Impact: Used for cross-chain operation tracking and correlation.

Branches and code coverage (including function calls)

Intended branches

Negative behavior

Zellic © 2025Back to top ↑