Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>WOOFI Stake>Threat Model>emergencyUnstake
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionInstant withdraw cap can be bypassedSimilarities to ERC-4626 first-deposit issueSlippage check not performed during compoundReward function
Threat ModelWhat are threat models?BaseStrategy.solStrategyAave.solVaultV2.solWooLendingManager.solWooStakingCompounder.solWooStakingController.sol
WooStakingLocal.solcompoundAllcompoundMPemergencyUnstakeinCaseTokenGotStucksetAutoCompoundstakeunstakeunstakeAll
WooStakingManager.solWooStakingProxy.solWooSuperChargerVaultV2.solWooWithdrawManagerV2.sol
Audit ResultsAssessment Results

Function: emergencyUnstake()

This allows the caller to unstake its tokens in an emergency. Does not unstake Woo in the staking manager. Emergencies can only be enabled by the admin.

Branches and code coverage

Intended branches

  • Called during an emergency.

Negative behavior

  • Called outside an emergency.

Zellic © 2024Back to top ↑