Assessment reports>Stable Predeposit>Threat Model>transferToTreasury

Function: transferToTreasury(uint256 amount)

This function is a treasury role hook used during Yield mode to deploy KYC-approved USDC to the designated treasury address, decreasing the deployable accounting bucket. It is only callable by TREASURY_ROLE holders within the Yield phase.

Inputs

  • amount

    • Control: N/A.

    • Constraints: Must be nonzero, <= usdcKycDeployable, and <= on-contract USDC balance.

    • Impact: Reduces usdcKycDeployable and transfers the same amount of USDC to _treasuryAddress.

Branches and code coverage

Intended branches

  • Revert if the amount is greater than usdcKycDeployable.

  • Revert if the amount is greater than the contract's USDC balance.

  • Transfer the amount of USDC to _treasuryAddress.

Negative behavior

  • The caller is not the TREASURY_ROLE holder, and calls outside the Yield phase revert.

Function call analysis

  • HourglassStableVaultKYC.USDC.balanceOf(address(this))

    • What is controllable? USDC address is constant.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • SafeERC20.safeTransfer(HourglassStableVaultKYC.USDC, _treasuryAddress, amount)

    • What is controllable? USDC address is constant, and _treasuryAddress is set by the admin.

    • If the return value is controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

Zellic © 2025Back to top ↑