Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>EtherFi>Threat Model>batchPartialWithdrawOptimized
GeneralOverview
Findings
Critical (5)
High (1)
Medium (3)
Low (1)
Informational (1)
DiscussionUnused variables could be removed
Threat ModelWhat are threat models?EtherFiNode.sol
EtherFiNodesManager.solbatchFullWithdrawbatchPartialWithdrawbatchPartialWithdrawOptimizedbatchQueueRestakedWithdrawalbatchRevertExitRequestbatchSendExitRequestcreateUnusedWithdrawalSafe
LiquidityPool.solStakingManager.sol
Audit ResultsSummary

Function: batchPartialWithdrawOptimized(uint256[] _validatorIds)

Optimized version of batchPartialWithdraw.

Inputs

  • _validatorIds

    • Control: Fully controlled.

    • Constraints: No specific constraints.

    • Impact: Validator IDs for which optimized partial withdrawals need to be executed.

Branches and code coverage

Intended branches

  • Updates the etherFiNode related to each validator ID.

  • Distributes the rewards to all the entities.

Negative behavior

  • Revert if the owners of TNFT, BNFT, and and the node operator are not consistent among the provided validator IDs.

Function call analysis

  • this.auctionManager.getBidOwner(_validatorIds[0])

    • What is controllable? _validatorIds[0].

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the bid owner from the auction manager related to the first validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this.tnft.ownerOf(_validatorIds[0])

    • What is controllable? _validatorIds[0].

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the owner of the TNFT related to the first validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this.bnft.ownerOf(_validatorIds[0])

    • What is controllable? _validatorIds[0].

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the owner of the BNFT related to the first validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this.auctionManager.getBidOwner(_validatorId)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the bid owner from the auction manager related to each validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this.tnft.ownerOf(_validatorId)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the owner of the TNFT related to each validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this.bnft.ownerOf(_validatorId)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the owner of the BNFT related to each validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this._updateEtherFiNode(_validatorId) -> IEtherFiNode(etherfiNode).version()

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the version of etherFiNode.

    • What happens if it reverts, reenters, or does other unusual control flow? If this call reverts, it might indicate an issue with the EtherFiNode or an unexpected state.

  • this._updateEtherFiNode(_validatorId) -> IEtherFiNode(etherfiNode).DEPRECATED_exitRequestTimestamp()

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the deprecated exit-request timestamp.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this._updateEtherFiNode(_validatorId) -> IEtherFiNode(etherfiNode).DEPRECATED_exitTimestamp()

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the deprecated exit timestamp.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this._updateEtherFiNode(_validatorId) -> IEtherFiNode(etherfiNode).DEPRECATED_phase()

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the deprecated phase.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this._updateEtherFiNode(_validatorId) -> IEtherFiNode(etherfiNode).migrateVersion(_validatorId)

    • What is controllable? _validatorId.

    • If the return value is controllable, how is it used and how can it go wrong? Updates the EtherFiNode version related to each validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? If this call reverts, it might indicate an issue with migrating the version — no reentrancy scenario.

  • IEtherFiNode(etherfiNode).claimQueuedWithdrawals (this.maxEigenlayerWithdrawals, False)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Claims queued withdrawals from the EtherFiNode related to each validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? If this call reverts, it might indicate an issue with claiming queued withdrawals — no reentrancy scenario.

  • this._getTotalRewardsPayoutsFromSafe(_validatorId, True) -> IEtherFiNode(etherfiNode).numExitRequestsByTnft()

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Retrieves the number of exit requests by TNFT from the EtherFiNode.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

  • this._getTotalRewardsPayoutsFromSafe(_validatorId, True) -> IEtherFiNode(etherfiNode).getRewardsPayouts(this.validatorInfos [_validatorId].exitRequestTimestamp, this.stakingRewardsSplit)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Calculates total rewards payouts from the safe related to each validator ID.

    • What happens if it reverts, reenters, or does other unusual control flow? If this call reverts, it might indicate an issue with calculating rewards payouts — no reentrancy scenario.

  • IEtherFiNode(etherfiNode).moveFundsToManager(total)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Moves funds from the EtherFiNode related to each validator ID to the manager.

    • What happens if it reverts, reenters, or does other unusual control flow? If this call reverts, it might indicate an issue with moving funds to the manager — no reentrancy scenario.

Zellic © 2025Back to top ↑