Assessment reports>Smart Vault>Threat Model>withdraw

Function: withdraw(WithdrawParams withdrawParams)

This function is used to withdraw underlying asset from a smart vault.

Inputs

  • withdrawParams

    • Control: Fully controllable by the caller.

    • Constraints: Address of the vault must be whitelisted by the owner.

    • Impact: Address of the vault, amount to withdraw, and the receiver address.

Branches and code coverage

Intended branches

  • Check the vault address is valid by calling _checkVaultIsValid.

  • Call withdraw on the vault.

  • Emit the Withdraw event.

Negative behavior

  • Revert if the contract is paused.

  • Revert if the provided vault address is not valid.

Function call analysis

  • vault.withdraw(amount, msg.sender, receiver)

    • What is controllable? vault but whitelisted by owner, amount, and receiver.

    • If the return value is controllable, how is it used and how can it go wrong? The return value is not used.

    • What happens if it reverts, reenters or does other unusual control flow? The revert indicates a failure in the vault withdrawal, and reentrancy is not an issue since there are no subsequent values affected by the CEI pattern.

Zellic © 2025Back to top ↑