Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Nocturne>Threat Model>retrieveETHDeposit
GeneralOverview
Findings
High (2)
Low (3)
DiscussionGas tokens can be identified by index in OperationSchnorr signature documentation typoRedundant order-l check
Threat ModelWhat are threat models?BalanceManager.solCommitmentTreeManager.sol
DepositManager.solcompleteErc20DepositinstantiateETHMultiDepositinstantiateErc20MultiDepositretrieveDepositretrieveETHDeposit
Handler.solTeller.solcircuits
Audit ResultsSummary

Function: retrieveETHDeposit(DepositRequest req)

This cancels and retrieves pending ETH deposit.

Inputs

  • req

    • Control: Arbitrarily set by caller.

    • Constraints: Digest must be in outstanding deposit requests.

    • Impact: Outstanding deposit request cleared and sends back ETH.

Branches and code coverage

Intended branches

  • Successfully retrieves ETH deposit.

Negative behavior

  • Caller is not spender.

  • Deposit type was not ETH.

  • Deposit was not in outstanding deposit requests.

Zellic © 2024Back to top ↑