Assessment reports>SyncSwap>Threat Models>transferAndDeposit

Function: transferAndDeposit(address token, address to, uint256 amount)

Allows to transfer and deposit an ERC20 token in a single call. Also allows to deposit ETH.

Inputs

  • token

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Determines the asset to be deposited.

  • to

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Determines the recipient of the deposit.

  • amount

    • Control: Arbitrary.

    • Constraints: None if operating on ERC20; amount == msg.value if operating on ETH.

    • Impact: Determines the amount to be transferred.

Branches and code coverage (including function calls)

Intended branches

Allows to deposit an ERC20: transfers and deposits the requested amount.

Allows to deposit ETH.

Negative behavior

ERC20 balance insufficient to cover the deposit.

Function call analysis

  • rootFunction -> IWETH(wETH).transferFrom(msg.sender, address(this), amount)

    • What is controllable? amount.

    • If return value controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters, or does other unusual control flow? Reverts are bubbled up; reentrancy is not a concern.

  • rootFunction -> IWETH(wETH).withdraw(amount)

    • What is controllable? amount.

    • If return value controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters, or does other unusual control flow? Cannot revert or reenter.

  • rootFunction -> TransferHelper.safeTransferFrom(token, msg.sender, address(this), amount)

    • What is controllable? token, amount.

    • If return value controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters, or does other unusual control flow? Reverts are bubbled up; reentrancy is prevented via the nonReentrant modifier.

Zellic © 2024Back to top ↑