Assessment reports>SAX>Threat Model>Function: function claimTokens(bytes32[] proof, uint256 epoch, uint256 index, uint256 tokenIdx, uint16 shareBbps)

Function: function claimTokens(bytes32[] proof, uint256 epoch, uint256 index, uint256 tokenIdx, uint16 shareBbps)

The function allows the user to claim their share if provided a valid Merkle proof. The merkleRoot data for verification can be only provided by the owner of the contract using the updateTokenShares function. The caller of the function cannot control recipient address, so they can only claim the funds assigned to them. At the same time, the caller has control of which of the epochs they want to claim funds.

Inputs

  • proof

    • Validation: The MerkleProofLib.verify function returns true if the proof is valid.

    • Impact: Merkle proof containing sibling hashes on the branch from the leaf to the root of the Merkle tree.

  • epoch

    • Validation: If tokenClaims[epoch][recipient] is true, the caller already claimed for this epoch.

    • Impact: Epoch for which the user wants to claim tokens.

  • index

    • Validation: Used to calculate the hash of the leaf; if MerkleProofLib.verify returns true, the index is valid.

    • Impact: It is used to calculate the hash, but in fact it is redundant.

  • tokenIdx

    • Validation: Used to calculate the hash of the leaf; if MerkleProofLib.verify returns true, the tokenIdx is valid.

    • Impact: The index of the token that will be claimed.

  • shareBbps

    • Validation: Used to calculate the hash of the leaf; if MerkleProofLib.verify returns true, the shareBbps is valid.

    • Impact: The portion of share.amounts[tokenIdx] transfererred to the caller, in basis points.

Branches and code coverage (including function calls)

Intended branches

  • The caller claimed funds properly.

Negative behavior

  • The invalid proof.

  • The tokenShares does not exist for epoch.

  • The caller already claimed funds for this epoch.

  • The invalid tokenIdx.

  • The invalid shareBbps.

Function call analysis

  • MerkleProofLib.verify(proof, share.merkleRoot, keccak256(abi.encodePacked(index, recipient, tokenIdx, shareBbps)

    • External/Internal? Internal.

    • Argument control? proof, index, tokenIdx, and shareBbps.

    • Impact: Returns true if leaf exists in the Merkle tree with root and given proof.

  • IERC20(token).safeTransfer(recipient, amount)

    • External/Internal? External.

    • Argument control? N/A.

    • Impact: Transfers the amount of token calculated based on shareBbps to the caller of the function.

Zellic © 2024Back to top ↑