Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>WOOFI Stake>Threat Model>deposit
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionInstant withdraw cap can be bypassedSimilarities to ERC-4626 first-deposit issueSlippage check not performed during compoundReward function
Threat ModelWhat are threat models?BaseStrategy.solStrategyAave.sol
VaultV2.soldepositearninCaseNativeTokensGetStuckinCaseTokensGetStuckproposeStratupgradeStratwithdraw
WooLendingManager.solWooStakingCompounder.solWooStakingController.solWooStakingLocal.solWooStakingManager.solWooStakingProxy.solWooSuperChargerVaultV2.solWooWithdrawManagerV2.sol
Audit ResultsAssessment Results

Function: deposit(uint256 amount)

This allows a user to deposit funds into the vault.

Inputs

  • amount

    • Control: Fully controlled by the caller.

    • Constraints: Checked that the user can afford the deposit.

    • Impact: The amount of funds to be deposited.

Branches and code coverage

Intended branches

  • Check that msg.value matches amount in the case of a native deposit.

  • Ensure that msg.value is zero in the case of an ERC-20 deposit.

  • Ensure that the strategy is not paused.

  • Deposit the native tokens as WETH.

  • Transfer the ERC-20 tokens in the case of an ERC-20 deposit.

  • Mint the adequate amount of shares to the user.

  • Update the costSharePrice of the user.

  • Call the earn function so that the vault can earn yield on the freshly deposited funds.

Negative behavior

  • Should not allow the user to deposit more than they can afford.

Zellic © 2025Back to top ↑