Assessment reports>Lido Gateway>Threat Model>_beforeFinalizeWithdrawERC20

Function: _beforeFinalizeWithdrawERC20(address _l1Token, address _l2Token, address None, address None, uint256 None, byte[] None)

The hook that is called before finalizeWithdrawERC20 is executed.

Inputs

  • _l1Token

    • Control: Fully controlled by the caller.

    • Constraints: Has to be a supported L1 token.

    • Impact: The L1 token to be withdrawn.

  • _l2Token

    • Control: Fully controlled by the caller.

    • Constraints: Has to be a supported L2 token.

    • Impact: The L2 token that has been bridged.

Branches and code coverage (including function calls)

Intended branches

  • Ensure that l1Token is supported.

  • Ensure that l2Token is supported.

  • Ensure that withdrawalsEnabled is true.

Negative behavior

  • Should not allow msg.value > 0.

Zellic © 2024Back to top ↑