Assessment reports>Ostium>Threat Model>receiveAssets

Function: receiveAssets(uint256 assets, address user)

Make the vault receive assets. Normally called by OstiumTradingCallbacks to receive trading losses, but it is also callable by anyone wishing to donate to the vault.

Note that the user emitted in the event can be any address provided by the caller.

Inputs

  • assets

    • Control: Arbitrary.

    • Constraints: Transfer must succeed.

    • Impact: Amount of assets to distribute as rewards.

  • user

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Emitted in the event.

Branches and code coverage

Intended branches

  • Assets received successfully.

Negative behavior

  • Receive failed due to transfer failure.

Function call analysis

  • SafeERC20Upgradeable.safeTransferFrom(this._assetIERC20(), sender, address(this), assets)

    • What is controllable? Only assets.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? If the transfer fails, the call reverts. If there is reentrancy due to a future USDC upgrade that adds outgoing hooks, the state of the contract is the same and valid both before and after the transfer.

Zellic © 2024Back to top ↑