Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Nukem Loans>Threat Model>registerVsCredit
GeneralOverview
Findings
Critical (3)
High (3)
Medium (2)
Low (1)
DiscussionInitializer called in constructorBorrowing on behalf of the Market contractPotential storage-collision issueSaferERC20 additional checksEIP-712 implementationMarket setters should only be called onceUtilizing eth-brownie for testingCentralizationAMM oracle pricing
Threat ModelWhat are threat models?AbstractSwapper.solAuctions.solCollateral.solCredit.solDebt.solEIP712.solERC20Base.solERC20Permit.solEnFi4626.solLendingStrategy.sol
Market.solborrowcheckSignatureleveragerecallregisterCollateralregisterCreditregisterDebtregisterVsCreditsetAuctionssetStrategysetSwappersetTreasury
ProxyManager.solRoles.solSaferERC20.solUniswapV2Swapper.sol
Audit ResultsSummary

Function: registerVsCredit(address vsCredit_)

This sets the vsCredit contract address.

Inputs

  • vsCredit_

    • Control: Fully controlled by the caller.

    • Constraints: Checked to be a valid address.

    • Impact: vsCredit address.

Branches and code coverage (including function calls)

Intended branches

  • Should set the vsCredit address.

  • Ensure that the vsCredit's market is the same as this address. Similar additional cross-checks could be added.

Negative behavior

  • Should not be callable by anyone other than the owner.

  • Presumably should not be callable more than once.

Zellic © 2024Back to top ↑