Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Tradoor>Threat Model>Message: SetManager
GeneralOverview
Findings
High (1)
Medium (1)
Low (1)
Informational (4)
DiscussionTest suiteUnused isPending flag on perpetual ordersLimited contract storage enables denial-of-service attacks
Threat ModelWhat are threat models?
1-usdt_pool.tactMessage: ListTokenMessage: CancelPerpOrderMessage: ExecutePerpOrderMessage: LiquidatePerpPositionMessage: ADLPerpPositionMessage: UpdateBaseConfigMessage: SetManagerMessage: JettonUpdateContentMessage: DelistTokenMessage: ClaimProtocolFeeMessage: FeedPricesMessages: CreateCompensate and ExecuteOrCancelCompensateMessage: JettonTransferNotificationMessage: CancelLiquidityOrderMessage: ExecuteLiquidityOrderMessage: CreateDecreasePerpOrderMessage: CreateTpSlPerpOrder
2-ton_pool.tact
Audit ResultsAssessment Results

Message: SetManager

This operation allows the multisig to change the manager, compensator, and claimer addresses. There is no timelock on this operation.

Note that the owner can change the multisig address using the UpdateBaseConfig message, and therefore, the owner inherently has all of the capabilities that the multisig, manager, compensator, and claimer also have.

Inputs

The incoming message has the following structure:

message SetManager { manager: Address; compensator: Address; claimer: Address; }

  • manager

    • Validation: None.

    • Impact: The new manager address.

  • compensator

    • Validation: None.

    • Impact: The new compensator address.

  • claimer

    • Validation: None.

    • Impact: The new claimer address.

Test coverage

Intended branches

Negative behavior

Zellic © 2025Back to top ↑