Assessment reports>Staking>Threat Model>execute

Function: execute(address _stakingContract, byte[] _data)

Executes an arbitrary function.

Inputs

  • _stakingContract

    • Control: Full.

    • Constraints: Function must support the staking interfaces.

    • Impact: The target contract to be arbitrarily called.

  • _data

    • Control: Full.

    • Constraints: None.

    • Impact: The data.

Branches and code coverage (including function calls)

Intended branches

  • Verifies the returned result.

Negative behavior

  • Ensure that functions without the supported interfaces cannot be called

Function call analysis

  • execute -> _stakingContract.supportsInterface(type(IRewardTracker).interfaceId)

    • What is controllable? _stakingContract.

    • What happens if it reverts, reenters, or does other unusual control flow? N/A.

    • If return value is controllable, how is it used and how can it go wrong: Used to determine if the contract is one of the correct types. (Also stops arbitrary calls to random tokens, in case of compromise.)

Zellic © 2024Back to top ↑