Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Tradoor>Threat Model>Message: UpdateBaseConfig
GeneralOverview
Findings
High (1)
Medium (1)
Low (1)
Informational (4)
DiscussionTest suiteUnused isPending flag on perpetual ordersLimited contract storage enables denial-of-service attacks
Threat ModelWhat are threat models?
1-usdt_pool.tactMessage: ListTokenMessage: CancelPerpOrderMessage: ExecutePerpOrderMessage: LiquidatePerpPositionMessage: ADLPerpPositionMessage: UpdateBaseConfigMessage: SetManagerMessage: JettonUpdateContentMessage: DelistTokenMessage: ClaimProtocolFeeMessage: FeedPricesMessages: CreateCompensate and ExecuteOrCancelCompensateMessage: JettonTransferNotificationMessage: CancelLiquidityOrderMessage: ExecuteLiquidityOrderMessage: CreateDecreasePerpOrderMessage: CreateTpSlPerpOrder
2-ton_pool.tact
Audit ResultsAssessment Results

Message: UpdateBaseConfig

This operation allows the owner to update the configuration of the contract, including

  • the multisig address (therefore, the owner inherits all capabilities of the multisig, manager, compensator, and claimer, which can be set using the SetManager message),

  • the tlpJetton address,

  • the tlpWallet address,

  • the jettonWallet address,

  • which addresses are considered trusted executors, and

  • execution fees, minStorageReserve, and all gas parameters.

Inputs

The incoming message has the following structure:

struct GasConfig { mintJettonGas: Int as coins; burnJettonGas: Int as coins; transferJettonGas: Int as coins; createPerpOrderGas: Int as coins; cancelPerpOrderGas: Int as coins; executePerpOrderGas: Int as coins; createLiquidityOrderGas: Int as coins; cancelLiquidityOrderGas: Int as coins; executeLiquidityOrderGas: Int as coins; minStorageReserve: Int as coins; lpMinExecutionFee: Int as coins; perpMinExecutionFee: Int as coins; } struct ExecutorConfig { executors: map; } struct ContractConfig { multisig: Address; tlpJetton: Address; tlpWallet: Address; jettonWallet: Address; } message UpdateBaseConfig { gasConfig: GasConfig?; executorConfig: ExecutorConfig?; contractConfig: ContractConfig?; }

  • gasConfig

    • Validation: None.

    • Impact: Specifies the new gas parameters to use.

  • executorConfig

    • Validation: None.

    • Impact: Specifies the new trusted executors to enable or disable.

  • contractConfig

    • Validation: None.

    • Impact: Specifies the new multisig, tlpJetton, tlpWallet, and jettonWallet addresses to use.

Test coverage

Intended branches

Negative behavior

Zellic © 2025Back to top ↑