Assessment reports>Smart Vault>Threat Model>claim

Function: claim(address owner, address receiver)

This function is used to claim rewards from the smart vault. It is expected to be called from the smart vault manager.

Inputs

  • owner

    • Control: Fully controllable by the caller (smartVaultManager).

    • Constraints: None.

    • Impact: Address of the share owner.

  • receiver

    • Control: Fully controllable by the caller (smartVaultManager).

    • Constraints: None.

    • Impact: Address of the receiver.

Branches and code coverage

Intended branches

  • Check if the current timestamp is within the claim time range.

  • Update the reward for the owner.

  • Update the pending rewards and transfer the rewards to the receiver, for each reward token, if the pending rewards is not zero.

  • Call the transferAllocatedTokens function of the reward vault to transfer the rewards to the receiver.

  • Emit the Claimed event.

  • Invoke the _manageDebtAndStake function.

  • Skip when staking is disabled.

  • Calculate the underlying token value using the manager's fetchPrice function.

  • Calculate the target staking amount using the staking factor.

    • If the target is greater than the minted, mint the debt token and adjust the staking amount.

    • If the target is less than the minted, burn the debt token and adjust the staking amount.

Negative behavior

  • Revert if the caller is not the manager.

  • Revert if the contract is paused.

  • Revert if the amount is zero.

  • Revert if the pending rewards are not zero.

  • Revert if minting/burning the debt token fails.

Function call analysis

  • this._claim(owner, receiver) -> this.rewardVault.transferAllocatedTokens(allocation)

    • What is controllable? allocation is set by the owner and receiver.

    • If the return value is controllable, how is it used and how can it go wrong? The return value is not used.

    • What happens if it reverts, reenters or does other unusual control flow? A revert indicates no allocation for the receiver in the reward vault or when the reward vault does not have a sufficient balance.

  • Other external call flows are the same as the depositERC20 function's _manageDebtAndStake flow of SmartVault.

Zellic © 2025Back to top ↑