Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Stable Predeposit>Threat Model>setTreasuryAddress
GeneralOverview
Findings
Medium (1)
DiscussionCode-quality improvementsLack of bridging gas refunds
Threat ModelWhat are threat models?HourglassStableVault.solHourglassStableVaultBridge.solHourglassStableVaultFrax.sol
HourglassStableVaultKYC.solbatchSetKycStatusdepositmodifyPendingDepositWindowmodifyStartedDepositWindowpreviewRedeemFunction: recoverErc20(address token, address to)recoverEthredeemBridgeredeemKycredeemNonKycredeemRecoveryKycsetBridgeContractsetDepositCapsetTreasuryAddresstransferToTreasurytransitionToKycModetransitionToRecoveryModetransitionToWithdrawModetransitionToYieldMode
Audit ResultsAssessment Results

Function: setTreasuryAddress(address newTreasury)

This function updates the destination address for treasury operations — only callable by ADMIN_ROLE holders.

Inputs

  • newTreasury

    • Control: N/A.

    • Constraints: Must be nonzero.

    • Impact: Updates the _treasuryAddress state variable.

Branches and code coverage

Intended branches

  • Update the _treasuryAddress with the new treasury address.

Negative behavior

  • Non-admin callers revert.

Function call analysis

  • None.

Zellic © 2025Back to top ↑