Assessment reports>Staking>Threat Model>stakeForAccount

Function: stakeForAccount(address _fundingAccount, address _account, address _depositToken, uint256 _amount)

Allows staking of tokens on behalf of another account.

Inputs

  • _fundingAccount

    • Control: Fully controlled by the caller (handler).

    • Constraints: None.

    • Impact: The account that will be used to fund the staking.

  • _account

    • Control: Fully controlled by the caller (handler).

    • Constraints: None.

    • Impact: The account that will be staked for.

  • _depositToken

    • Control: Controlled by the caller (handler).

    • Constraints: Checked that the token is whitelisted (isDepositToken).

    • Impact: The token to be staked.

  • _amount

    • Control: Controlled by the caller (handler).

    • Constraints: Checked that the amount is greater than zero. Also, in the safeTransferFrom call, it is checked that the _fundingAccount (in this case, msg.sender) has enough balance.

    • Impact: The amount of tokens to be staked.

Branches and code coverage (including function calls)

Intended branches

  • Assumes no malicious intent on behalf of the handler.

  • Checks that the token is whitelisted (isDepositToken).

  • Checks that the amount is greater than zero.

  • Checks that the _fundingAccount has enough balance (safeTransferFrom).

  • Updates the rewards for the _account.

  • Updates the stakedAmounts for the _account.

  • Updates the depositBalances for the _account.

  • Updates the totalDepositSupply for the _depositToken.

  • Mints the _amount of tokens to the _account.

Negative behavior

  • Should not be callable by anyone other than a handler.

  • Should not be callable if isPrivateStakingMode is true.

Zellic © 2024Back to top ↑