Assessment reports>Staking>Threat Model>unstakeForAccount

Function: unstakeForAccount(address _account, address _receiver, uint256 _depositToken, address _amount)

Allows unstaking of tokens on behalf of another account.

Inputs

  • _account

    • Control: Fully controlled by the caller (handler).

    • Constraints: Checked that _account can afford to unstake _amount of _depositToken (via depositBalances, stakedAmounts, etc.).

    • Impact: The account that will be unstaked for.

  • _receiver

    • Control: Fully controlled by the caller (handler).

    • Constraints: None.

    • Impact: The beneficiary of the deposit tokens resulting from the unstaking.

  • _depositToken

    • Control: Fully controlled by the caller (handler).

    • Constraints: Checked that the token is whitelisted (isDepositToken).

    • Impact: The token to be unstaked.

  • _amount

    • Control: Fully controlled by the caller (handler).

    • Constraints: Checked that the amount is greater than zero. Also, in safeTransfer call, it is checked that the _account has enough balance.

    • Impact: The amount of tokens to be unstaked.

Branches and code coverage (including function calls)

Intended branches

  • Assumes no malicious intent on behalf of the handler.

  • Checks that the token is whitelisted (isDepositToken).

  • Checks that the amount is greater than zero.

  • Checks that the _account has enough balance (safeTransfer) --- also the check in depositBalances.

  • Decreases the total deposit supply for the _depositToken.

  • Decreases the depositBalances for the _account.

  • Decreases the stakedAmounts for the _account.

  • Decreases the balances for the _account (by burning this contract's tokens).

  • Transfers the _amount of deposit tokens back to the _account.

Negative behavior

  • Should not be callable by anyone other than a handler.

  • Should not allow withdrawing more than the staked amount.

  • Should not be callable if isPrivateStakingMode is true.

  • Assumes user cannot unstake a token that they have not staked. That is handled by the depositBalances decrease.

  • Should not allow unstaking more tokens than the user has staked.

Zellic © 2024Back to top ↑