Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Nocturne>Threat Model>depositFunds
GeneralOverview
Findings
High (2)
Low (2)
Informational (1)
DiscussionGas tokens can be identified by index in OperationSchnorr signature documentation typoRedundant order-l check
Threat ModelWhat are threat models?BalanceManager.solCommitmentTreeManager.solDepositManager.solHandler.sol
Teller.soldepositFundsprocessBundle
circuits
Audit ResultsSummary

Function: depositFunds(Deposit deposit)

This is called by an authorized deposit source to deposit funds. Inserts the refund note into the Merkle tree if valid.

Inputs

  • deposit

    • Control: Arbitrarily set by caller.

    • Constraints: None checked by this contract (see Handler.handleDeposit in section ref↗ for more details).

    • Impact: Calls Handler.handleDeposit with deposit and transfers deposit.encodedAsset (assumed to be an ERC-20 token) from sender to Teller.

Branches and code coverage

Intended branches

  • Call into Handler.handleDeposit.

Negative behavior

  • Contract is paused.

  • Caller is not deposit source.

  • handleDeposit reverts.

Zellic © 2025Back to top ↑