Assessment reports>Orderly Network>Threat Model>withdraw

Function: withdraw(VaultTypes.VaultWithdraw data)

This allows to transfer withdrawn funds to the receiver. The data is almost controlled by the initiator of cross-chain messages in main chain. This function only performs this action without any validation, because all validation checks should be done in the main chain.

Inputs

  • data

    • Control: The data is controlled by the sender of cross-chain messages. In this case, this is an operator of the OperatorManager contract.

    • Constraints: N/A.

    • Impact: Contains the amount of tokens that will be transferred to the receiver as well as the fee amount, the hash of the token that will be transferred, and the sender who initiated the withdrawn action.

Branches and code coverage

Negative behavior

  • Caller is not onlyCrossChainManager.

Function call analysis

  • tokenAddress.safeTransfer(data.receiver, amount);

    • External/Internal? External.

    • Argument control? data.receiver is controlled by the sender of cross-chain messages, tokenAddress is associated with the provided tokenHash, and amount is the data.tokenAmount without data.fee.

    • Impact: Function transfers amount of tokens to the receiver, the address of the receiver, and the amount of tokens are controlled by a contract in the main chain.

Zellic © 2024Back to top ↑