Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Polygon Staking>Threat Model>performUpkeep
GeneralOverview
Findings
High (1)
Medium (1)
Low (4)
Informational (7)
DiscussionThe logic in _updateStrategyRewards may not need to update all the strategiesThe LSTRewardsSplitter's splitting is not path-independent, which may have cross-protocol implicationsCalling checkUpkeep on chain is against the automation documentation and may revert or waste gas
Threat ModelWhat are threat models?LSTRewardsSplitter.sol
LSTRewardsSplitterController.solperformUpkeepwithdraw
PolygonFundFlowController.solPolygonStrategy.solPolygonVault.sol
Audit ResultsAssessment Results

Function: performUpkeep(bytes calldata _performData)

This function splits rewards between fee receivers.

Inputs

  • _performData

    • Control: Fully controlled by the caller.

    • Constraints: N/A.

    • Impact: ABI-encoded list of splitters to call.

Branches and code coverage

Intended branches

  • Iterate through the list of splitters to call and call performUpkeep on them.

  • Check if any splitter was called.

Negative behavior

  • Revert transactions if any splitter was not called.

Zellic © 2025Back to top ↑