Assessment reports>Odos>Threat Models>transferRouterFunds

Function: transferRouterFunds(address[] tokens, uint256[] amounts, address dest)

This function allows the contract owner to transfer assets owned by the router (originating from fees and positive slippage).

Inputs

  • tokens

    • Control: Arbitrary.

    • Constraints: tokens.length == amounts.length.

    • Impact: List of token addresses to be transferred.

  • amounts

    • Control: Arbitrary.

    • Constraints: tokens.length == amounts.length.

    • Impact: Amounts of the tokens to be transferred.

  • dest

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Receiver of the transferred tokens.

Branches and code coverage (including function calls)

Intended branches

  • Transfers a specific amount of tokens.

  • Transfers the full balance of tokens.

  • Transfers a specific amount of ETH.

  • Transfers the full balance of ETH.

Negative behavior

  • Reverts if the caller is not the owner.

Function call analysis

  • rootFunction -> _universalBalance

    • What is controllable? The argument is controllable.

    • If return value controllable, how is it used and how can it go wrong? Return value is controllable by specifying an arbitrary token address; this has no meaningful consequence.

    • What happens if it reverts, reenters, or does other unusual control flow? Reverts are propagated upwards. Reentrancy into the contract is possible but not a concern.

  • rootFunction -> _universalTransfer

    • What is controllable? All arguments are controllable.

    • If return value controllable, how is it used and how can it go wrong? Return value is not used.

    • What happens if it reverts, reenters, or does other unusual control flow? Reverts are propagated upwards. Reentrancy into the contract is possible but not a concern.

Zellic © 2024Back to top ↑