Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>warpdotgreen-cli>Threat Model>bridgeEtherToChia
GeneralOverview
DiscussionAnyone can emit the SendMessage event directly without transferring tokensReentrancy in sendMessage by a minerMismatched transferTip condition between token minting and burning
Threat ModelWhat are threat models?
ERC20Bridge.sol_handleBridgingbridgeEtherToChiabridgeToChiabridgeToChiaWithPermitinitializePuzzleHashesreceiveMessage
MilliETH.solPortal.solWrappedCAT.sol
Audit ResultsAssessment Results

Function: bridgeEtherToChia(byte[32] _receiver, uint256 _maxMessageToll)

This function is used to bridge native Ether to Chia by first wrapping it into milliETH (or WETH). This function wraps Ether into an ERC-20, sends the portal tip, and sends a message to mint tokens on Chia.

Inputs

  • _receiver

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Receiver puzzle hash for the tokens.

  • _maxMessageToll

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Value of the maximum message toll.

Branches and code coverage

Intended branches

  • Call the deposit function of IWETH to wrap the Ether.

  • Call the decimals function of IWETH and update the factor.

  • Invoke the _handleBridging function.

Negative behavior

  • Check if the message toll is less than the maximum message toll.

  • Check if the amount after toll is greater than wethToEthRatio and divisible by wethToEthRatio.

Zellic © 2025Back to top ↑