Assessment reports>Origami Finance>Threat Model>withdraw

Function: withdraw(uint256 amount, address recipient)

Allows SupplyManager to withdraw assets from strategy. The appropriate amount of debt tokens will be burned.

Inputs

  • amount

    • Constraints: amount should not be more than available tokens (not on loan).

    • Impact: Amount of asset tokens to withdraw.

  • recipient

    • Constraints: No constraints.

    • Impact: Receiver of asset tokens.

Branches and code coverage

Intended branches

  • The withdraw was executed properly

Negative behavior

  • Caller is not a trusted SupplyManager.

  • amount is more than _globalAvailableToBorrow().

Function call analysis

  • this.debtToken.burn(address(this.idleStrategyManager), OrigamiMath.scaleUp(amount, this._assetScalar))

    • What is controllable? amount.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? Can revert if IdleStrategyManager does not own enough debt tokens.

  • this.idleStrategyManager.withdraw(amount, recipient)

    • What is controllable? amount and recipient.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? Can revert if amount is zero. If recipient address is zero, can revert due to an error during the withdraw process from the Strategy contract.

Zellic © 2025Back to top ↑