Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Nocturne>Threat Model>handleDeposit
GeneralOverview
Findings
High (2)
Low (2)
Informational (1)
DiscussionGas tokens can be identified by index in OperationSchnorr signature documentation typoRedundant order-l check
Threat ModelWhat are threat models?BalanceManager.solCommitmentTreeManager.solDepositManager.sol
Handler.solhandleDeposithandleOperation
Teller.solcircuits
Audit ResultsSummary

Function: handleDeposit(Deposit deposit)

This verifies a deposit note and adds it to the Merkle tree. Called only by Teller.

Inputs

  • deposit

    • Control: Arbitrarily set by any deposit source calling into Teller.depositFunds.

    • Constraints: The deposit.encodedAsset must be a supported contract. Note must pass checks (see CommitmentTreeManager._handleRefundNote in section ref↗ for more info).

    • Impact: Note details added to Merkle tree.

Branches and code coverage

Intended branches

  • Call into CommitmentTreeManager._handleRefundNote.

Negative behavior

  • Contract is paused.

  • Caller is not Teller.

  • Asset is not whitelisted.

  • The call to CommitmentTreeManager._handleRefundNote reverts.

Zellic © 2025Back to top ↑