Assessment reports>Wasabi>Threat Models>createERC20Pool

Function: createERC20Pool(address _tokenAddress, uint256 _initialDeposit, address _nftAddress, uint256[] _initialTokenIds, WasabiStructs.PoolConfiguration _poolConfiguration, WasabiStructs.OptionType[] _types, address _admin)

This function creates a new ERC20 based pool.

Inputs

  • _tokenAddress

    • Control: Fully controlled by user.

    • Constraints: Must have functional transferFrom function if

      _initialDeposit is nonzero.

    • Impact: Any contract can be used; those that are not ERC20

      compliant will likely cause problems with pool mechanics.

  • _initialDeposit

    • Control: Can be any uint256 value.

    • Constraints: Must be less than or equal to the balance of the

      sender in the given token.

    • Impact: Decides the initial balance of the pool.

  • _nftAddress

    • Control: User fully controls this value.

    • Constraints: If _initialTokenIds is set, the user must own all

      of them.

    • Impact: NFTs that behave in unexpected ways may cause problems

      with pool mechanics.

  • _initialTokenIds

    • Control: User fully controls this input.

    • Constraints: The IDs in this array must be owned by the user

      under the given NFT collection.

    • Impact: Decides the initial NFTs in the pool.

  • _poolConfiguration

    • Control: User fully controls this input.

    • Constraints: Checked by WasabiValidation.validate.

    • Impact: Configuration cannot have egregiously degenerate values

      (e.g., minimums must be less than maximums).

  • _types

    • Control: User fully controls this input.

    • Constraints: At least one type must be supplied.

    • Impact: Decides the types of options that can be created in the

      pool.

  • _admin

    • Control: User fully controls this input.

    • Constraints: None.

    • Impact: Decides the admin of the pool.

Branches and code coverage (including function calls)

Intended branches

  • A pool with valid configuration can be created.

Negative behavior

  • Pools can only be initialized one time.

  • A pool with invalid strike price configuration cannot be created.

  • A pool with invalid duration configuration cannot be created.

  • Pools without at least one option type cannot be created.

Function call analysis

  • createERC20Pool -> pool.initialize`

  • What is controllable? All parameters except for the factory address.

    • If return value controllable, how is it used and how can it go wrong? Return value is unused.

    • What happens if it reverts, reenters, or does other unusual control flow? If it reverts, the pool is not created.

  • createERC20Pool -> _poolAddress.transfer`

  • What is controllable? The amount of ETH to transfer.

    • If return value controllable, how is it used and how can it go wrong? Return value is unused.

    • What happens if it reverts, reenters, or does other unusual control flow? If it reverts, the pool is not created.

  • createERC20Pool -> token.transferFrom`

  • What is controllable? The sender and amount of tokens to transfer.

    • If return value controllable, how is it used and how can it go wrong? Return value is unused.

    • What happens if it reverts, reenters, or does other unusual control flow? Pool creation fails.

  • createERC20Pool -> nft.safeTransferFrom`

    • What is controllable? The sender and token ID to transfer.

    • If return value controllable, how is it used and how can it go wrong? Return value is unused.

    • What happens if it reverts, reenters, or does other unusual control flow? Pool creation fails.

Zellic © 2024Back to top ↑