Assessment reports>Metavest>Threat Model>withdraw

Function: withdraw(uint256 _amount)

This function is used to withdraw tokens from the allocation contract.

Inputs

  • _amount

    • Control: Arbitrary.

    • Constraints: Should be nonzero and less than the withdrawable amount.

    • Impact: Amount of tokens to withdraw from the allocation contract.

Branches and code coverage

Intended branches

  • Update tokensWithdrawn.

  • Send _amount tokens to the caller.

Negative behavior

  • Revert if the _amount is greater than the withdrawable amount.

  • Revert if the _amount is zero.

  • Revert if the function is reentered.

  • Revert if the caller is not grantee.

Function call analysis

  • this.getAmountWithdrawable()

    • What is controllable? N/A.

    • If the return value is controllable, how is it used and how can it go wrong? Return the amount of tokens that can be withdrawn. If the amount is less than the _amount, the function reverts.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • IERC20M(this.allocation.tokenContract).balanceOf(address(this))

    • What is controllable? N/A.

    • If the return value is controllable, how is it used and how can it go wrong? Return the token balance of the allocation contract. If the amount is less than the _amount, the function reverts.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • this.safeTransfer(this.allocation.tokenContract, msg.sender, _amount)

    • What is controllable? _amount.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

Zellic © 2024Back to top ↑