Assessment reports>GTE -- Perp>Threat Model>withdraw

Function: withdraw(address account, uint256 amount)

This function decreases the collateral[account] balance by amount. Reverts if the current collateral[account] is less than amount. It transfers the amount of the USDC tokens to the provided account from this contract and emits a Withdrawal event.

Inputs

  • account

    • Control: Full control.

    • Constraints: The caller should be the account itself or an approved operator of this account.

    • Impact: The withdrawal will be made from the account balance.

  • amount

    • Control: Full control.

    • Constraints: The account should own enough USDC tokens to transfer.

    • Impact: The amount of USDC tokens to be deposited.

Branches and code coverage

Intended branches

  • A Withdrawal event has been emitted.

  • The collateral balance of the account has been decreased by the amount.

  • The USDC balance of this contract has been decreased by the amount.

  • The USDC balance of the account has been increased by the amount.

Negative behavior

  • The caller is not an account or approved operator of this account.

  • The amount is greater than the collateral balance.

Function call analysis

  • MarginAccountLib.withdraw(this._getClearingHouse().collateralManager, account, amount) -> self.debitAccount(account, amount)

    • What is controllable? account and amount.

    • If the return value is controllable, how is it used and how can it go wrong? There is no return value.

    • What happens if it reverts, reenters or does other unusual control flow? It reverts if amount is greater than the balance.

  • MarginAccountLib.withdraw(this._getClearingHouse().collateralManager, account, amount) -> USDC.safeTransfer(account, amount)

    • What is controllable? account and amount.

    • If the return value is controllable, how is it used and how can it go wrong? There is no return value.

    • What happens if it reverts, reenters or does other unusual control flow? It reverts when the contract does not have enough USDC tokens.

Zellic © 2025Back to top ↑