Assessment reports>Silo Staking>Threat Model>Message: ExecuteMsg::Donate

Message: ExecuteMsg::Donate

This message could be used by anyone to provide utokens to the contract without receiving any ustake in return.

The parameter that a user can control is info.funds — the list of tokens sent along with the message.

The message executes the bond function with the donate parameter set to true. The function first validates the funds sent to it and then finds the validator with the smallest amount of delegation to delegate tokens to it. As the info.sender does not receive any ustake in return, neither the function does not calculate the mint amount nor the total supply of ustake is increased.

The function also stores the current snapshot of the balance, which is passed to the CallbackMsg::CheckReceivedCoin message, and the newly received coins are added to the unlocked_coins during the callback.

Zellic © 2024Back to top ↑