Assessment reports>Filecoin Services Payments>Threat Model>depositWithPermit

Function: depositWithPermit(address token, address to, uint256 amount, uint256 deadline, uint8 v, byte[32] r, byte[32] s)

This function uses an EIP-2612 permit from to to approve and deposit ERC-20 tokens to to’s account in a single transaction.

Inputs

  • token

    • Control: Fully controlled by the caller.

    • Constraints: Must be a non-native ERC-20 supporting EIP-2612 — native tokens not supported.

    • Impact: Asset to deposit via permit.

  • to

    • Control: Fully controlled by the caller.

    • Constraints: Must be nonzero and equal to msg.sender (permit recipient check).

    • Impact: Account credited and permit signer.

  • amount

    • Control: Fully controlled by the caller.

    • Constraints: N/A.

    • Impact: Intended amount to deposit (credited via balance delta).

  • deadline

    • Control: Fully controlled by the caller.

    • Constraints: Must be valid per token’s permit rules.

    • Impact: Permit-validity window.

  • v

    • Control: Fully controlled by the caller.

    • Constraints: Part of a valid ECDSA signature per EIP-2612.

    • Impact: Authorizes the allowance used for transfer.

  • r

    • Control: Fully controlled by the caller.

    • Constraints: Part of a valid ECDSA signature per EIP-2612.

    • Impact: Authorizes the allowance used for transfer.

  • s

    • Control: Fully controlled by the caller.

    • Constraints: Part of a valid ECDSA signature per EIP-2612.

    • Impact: Authorizes the allowance used for transfer.

Branches and code coverage

Intended branches

  • Use EIP-2612 permit to grant allowance, perform ERC-20 transferFrom into the contract, and increase to’s internal balance by amount (credit delta).

  • Reject zero recipient / incorrect permit recipient.

  • Reject invalid/expired permit.

Zellic © 2025Back to top ↑