Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Nukem Loans>Threat Model>leverage
GeneralOverview
Findings
Critical (3)
High (3)
Medium (2)
Low (1)
DiscussionInitializer called in constructorBorrowing on behalf of the Market contractPotential storage-collision issueSaferERC20 additional checksEIP-712 implementationMarket setters should only be called onceUtilizing eth-brownie for testingCentralizationAMM oracle pricing
Threat ModelWhat are threat models?AbstractSwapper.solAuctions.solCollateral.solCredit.solDebt.solEIP712.solERC20Base.solERC20Permit.solEnFi4626.solLendingStrategy.sol
Market.solborrowcheckSignatureleveragerecallregisterCollateralregisterCreditregisterDebtregisterVsCreditsetAuctionssetStrategysetSwappersetTreasury
ProxyManager.solRoles.solSaferERC20.solUniswapV2Swapper.sol
Audit ResultsSummary

Function: leverage(address authorizer, address market, uint256 price, uint256 deadline, uint8 v, bytes32 r, bytes32 s)

This allows leveraging with signature.

Inputs

  • authorizer

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be the owner of the contract and part of a valid signature.

    • Impact: Authorizer of the leverage.

  • market

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be the address of the contract.

    • Impact: Market address.

  • price

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be a valid price.

    • Impact: Price of the leverage.

  • deadline

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be in the future and part of a valid signature.

    • Impact: Deadline of the leverage.

  • amount

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be a valid amount --- not included in the signature.

    • Impact: Amount of the leverage.

  • v

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be a valid signature.

    • Impact: Signature v.

  • r

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be a valid signature.

    • Impact: Signature r.

  • s

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be a valid signature.

    • Impact: Signature s.

Branches and code coverage (including function calls)

Intended branches

  • Ensure that the signature constructed from authorizer, market, price, deadline, v, r, and s is valid.

  • Ensure the authorizer is the owner of the contract.

  • Ensure that the market is the address of the contract.

  • Ensure that the deadline is in the future.

  • Validate the amount to be leveraged against the price.

  • Increase the collateral balance of the sender by the amount leveraged.

  • Increase the debt balance of the sender by the amount leveraged.

  • Mint to the Market the credit fee amount.

Negative behavior

  • Signature should not be replayable. Currently it is.

  • Assumes _owner cannot be address(0).

Zellic © 2025Back to top ↑