Assessment reports>Tradoor>Threat Model>Messages: CreateCompensate and ExecuteOrCancelCompensate

Messages: CreateCompensate and ExecuteOrCancelCompensate

The CreateCompensate message allows the executor to register a Compensate request that is executable after three days using ExecutorOrCancelCompensate. It may be canceled at any time.

Only the compensator may create, execute, or cancel these requests.

Executing the Compensate request performs the following actions:

  • Deletes an orderId from liquidityOrders or perpOrders and perpOrderEx, if orderType is not null

  • Transfers an arbitrary amount of jettons to an arbitrary address, if refundReceiver is not null and refundAmount is nonzero

  • Transfers an arbitrary fee to the compensate receiver, if executionFeeReceiver is not null and executionFee is nonzero

  • Deletes the compensateId (request ID) from the map that stores the requests

Inputs

The incoming messages have the following structures:

message CreateCompensate { orderType: Int? as uint8; orderId: Int as uint64; trxId: Int as uint64; refundReceiver: Address?; refundAmount: Int as coins; executionFeeReceiver: Address?; executionFee: Int as coins; }
  • orderType

    • Validation: None.

    • Impact: Determines which map the orderId should be removed from, if any.

  • orderId

    • Validation: None.

    • Impact: Determines which value to remove from the map chosen by orderType. If the order does not exist, the request can still be created, but when executed, nothing will be removed from the map.

  • trxId

    • Validation: None.

    • Impact: Identifier for the message — does not affect handler logic.

  • refundReceiver

    • Validation: None.

    • Impact: If not null and refundAmount is greater than zero, the executor will transfer refundAmount to this address. If null, no transfer occurs.

  • refundAmount

    • Validation: None.

    • Impact: If greater than zero and refundReceiver is not null, the executor will transfer this amount to refundReceiver. If zero, no transfer occurs.

  • executionFeeReceiver

    • Validation: None.

    • Impact: If not null and executionFee is greater than zero, the executor will transfer executionFee to this address. If null, no transfer occurs.

  • executionFee

    • Validation: None.

    • Impact: If greater than zero and executionFeeReceiver is not null, the executor will transfer this amount to executionFeeReceiver. If zero, no transfer occurs.

message ExecuteOrCancelCompensate { isCancel: Bool; compensateId: Int as uint64; trxId: Int as uint64; }
  • isCancel

    • Validation: None.

    • Impact: If true, the request is canceled. If false, the request is executed.

  • compensateId

    • Validation: The unlockTime associated with this compensateId must be less than the current time.

    • Impact: Specifies which request to execute or cancel. The request is always removed from the map on successful execution of the handler.

  • trxId

    • Validation: None.

    • Impact: Identifier for the message — does not affect handler logic.

Test coverage

The tests cover the basic logic of the CreateCompensate and execute path of the ExecuteOrCancelCompensate messages.

We recommend adding tests to cover negative cases (e.g., where parameter validation fails) to prevent regressions.

Intended branches

Negative behavior

Zellic © 2025Back to top ↑