Assessment reports>warpdotgreen-cli>Threat Model>bridgeToChiaWithPermit

Function: bridgeToChiaWithPermit(address _assetContract, byte[32] _receiver, uint256 _amount, uint256 _deadline, uint8 _v, byte[32] _r, byte[32] _s)

This function is used to bridge ERC-20 tokens to Chia with a permit allowing token spending. This function uses an ERC-20 permit for gas-efficient token approval and transfer in a single transaction.

Inputs

  • _assetContract

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Address of the ERC-20 token to bridge.

  • _receiver

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Receiver puzzle hash for the wrapped tokens.

  • _amount

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Amount to bridge to Chia, in Mojos.

  • _deadline

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Value of the permit deadline.

  • _v

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Value of the permit signature v.

  • _r

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Value of the permit signature r.

  • _s

    • Control: Arbitrary.

    • Constraints: None.

    • Impact: Value of the permit signature s.

Branches and code coverage

Intended branches

  • Call the decimals function of the asset contract and update the factor.

  • Call the permit function of target asset contract.

  • Invoke the _handleBridging function.

Negative behavior

  • Revert if msg.value is not equal to the message toll.

Function call analysis

  • ERC20Decimals(_assetContract).decimals()

    • What is controllable? _assetContract — it is not whitelisted.

    • If the return value is controllable, how is it used and how can it go wrong? If the decimals of the asset contract are manipulated, the factor will be set arbitrarily.

  • IERC20Permit(_assetContract).permit(msg.sender, address(this), _amount * factor, _deadline, _v, _r, _s)

    • What is controllable? _assetContract — it is not whitelisted.

Zellic © 2024Back to top ↑