Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>d3-doma>Threat Model>Function: requestTokenization(TokenizationVoucher calldata voucher, bytes calldata signature)
GeneralOverview
Findings
Critical (3)
Medium (1)
Low (6)
Informational (2)
Threat ModelWhat are threat models?DomaForwarder.solDomaRecordProxyFacet.solDomaRecordRegistrarClaimFacet.solDomaRecordRegistrarFacet.solERC7786GatewayReceiver.solERC7786GatewaySource.solMarketplace.solOwnershipToken.sol
ProxyDomaRecord.solFunction: bridge(uint256 tokenId, bool isSynthetic, string calldata targetChainId, string calldata targetOwnerAddress)Function: changeLockStatus(string calldata tokenId, bool isSynthetic, bool isTransferLocked, string calldata correlationId)Function: claimOwnership(uint256 tokenId, bool isSynthetic, ProofOfContactsVoucher calldata proofOfContactsVoucher, bytes calldata signature)Function: detokenize(string calldata tokenId, bool isSynthetic, string calldata claimedBy, string calldata correlationId)Function: detokenizeUnchecked(string calldata tokenId, bool isSynthetic, string calldata correlationId)Function: mintOwnershipTokens(uint256 registrarIanaId, OwnershipTokenInfo[] calldata tokens, string calldata ownerAddress, string calldata correlationId)Function: renew(string calldata tokenId, bool isSynthetic, uint256 expiresAt, string calldata correlationId)Function: requestDetokenization(uint256 tokenId, bool isSynthetic)Function: requestTokenization(TokenizationVoucher calldata voucher, bytes calldata signature)Function: tokenTransfer(uint256 tokenId, address from, address to)
Audit ResultsAssessment Results

Function: requestTokenization(TokenizationVoucher calldata voucher, bytes calldata signature)

This function initiates domain tokenization requests by validating signed vouchers from registrars, verifying domain names, collecting fees, and sending cross-chain tokenization requests to Doma chain via _relayMessage for registrar approval.

Inputs

  • voucher

    • Control: Full.

    • Constraints: Expiration checked via _verifyNotExpiredVoucher(), nonce verified via _verifyAndUpdateNonce(), and owner must match msg.sender.

    • Impact: Contains names array, nonce, expiration, and owner address for tokenization request.

  • signature

    • Control: Full.

    • Constraints: Verified via _verifyRegistrarSignature() to ensure voucher was signed by an authorized registrar.

    • Impact: Ensures voucher authenticity and prevents unauthorized tokenization requests.

Branches and code coverage (including function calls)

Intended branches

Negative behavior

Zellic © 2025Back to top ↑