Zellic - Audit Reports

Assessment reports>Stable Predeposit>Threat Model>Function: bridgeToStableWithPermit(uint256 shares, address recipient, bytes lzOpts, uint16 slippageBps, uint256 deadline, uint8 v, byte[32] r, byte[32] s)

GeneralOverview

Findings

Medium (1)

DiscussionCode-quality improvements Lack of bridging gas refunds

Threat ModelWhat are threat models?HourglassStableVault.sol

HourglassStableVaultBridge.sol Function: bridgeToStable(uint256 shares, address recipient, bytes lzOpts, uint16 slippageBps)Function: bridgeToStableWithPermit(uint256 shares, address recipient, bytes lzOpts, uint16 slippageBps, uint256 deadline, uint8 v, byte[32] r, byte[32] s)recoverErc20 recoverEth

HourglassStableVaultFrax.sol HourglassStableVaultKYC.sol

Audit ResultsAssessment Results

Function: `bridgeToStableWithPermit(uint256 shares, address recipient, bytes lzOpts, uint16 slippageBps, uint256 deadline, uint8 v, byte[32] r, byte[32] s)`

This function is very similar to bridgeToStable as it calls the same internal function, but it uses an ERC-20 permit to approve the bridge contract to spend the user's vault shares, instead of requiring a prior approval transaction. Please read our notes in the signoff above for the bridgeToStable function, as they apply here as well.