Assessment reports>Maia DAO Ulysses Protocol>Threat Model>replenishReserves

Function: replenishReserves(address _strategy, address _token)

This function allows any caller to repay the reserves lacking of _token tokens from the _strategy contract.

Inputs

  • _strategy

    • Control: Full control by the caller.

    • Constraints: There are no constraints.

    • Impact: The contract of the strategy from which funds will be withdrawn to fill the reserves lacking but no more than reservesLacking.

  • _token

    • Control: Full control by the caller.

    • Constraints: There are no constraints.

    • Impact: Specifies the token in which the debt is being repaid.

Branches and code coverage

Intended branches

  • Check that tokens have been transferred from the _strategy.

  • Check that getPortStrategyTokenDebt has been decreased.

Negative behavior

  • The _strategy is not trusted.

Function call analysis

  • IPortStrategy(_strategy).withdraw(address(this), _token, amountToWithdraw)

    • What is controllable? The _token is controlled by the caller.

    • If the return value is controllable, how is it used and how can it go wrong? There is no return value.

    • What happens if it reverts, reenters or does other unusual control flow? The function has a lock against reentrancy attacks. The _strategy contract is not guaranteed to be trusted.

Zellic © 2024Back to top ↑