Assessment reports>WOOFI Stake>Threat Model>unstakeWoo

Function: unstakeWoo(address _user, uint256 _amount)

This unstakes WOO tokens for the given user. Only indirectly callable from, for example, WooStakingController, which is an admin for this contract. Also, it removes a proportional amount of MP tokens.

Inputs

  • _user

    • Control: Not controllable by the initial caller.

    • Constraints: Limited to be the initial caller address.

    • Impact: The address debited with the unstake.

  • _amount

    • Control: Fully controlled by the caller.

    • Constraints: Nonzero.

    • Impact: The amount to unstake.

Branches and code coverage

Intended branches

  • Single unstake.

  • Repeated unstake.

Negative behavior

  • Unstake a larger amount than the user has available.

Function call analysis

  • this.compounder.removeUserIfThresholdFail(_user)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Return value is ignored.

    • What happens if it reverts, reenters or does other unusual control flow? Cannot revert. User is removed from the compounder's users list if the new staked balance falls under autoCompThreshold.

  • EnumerableSet.remove(this.stakers, _user)

    • What is controllable? Not controllable.

    • If the return value is controllable, how is it used and how can it go wrong? Return value is ignored.

    • What happens if it reverts, reenters or does other unusual control flow? Cannot revert. If the user does not exist in the list, a boolean is returned (but ignored). Normally this cannot happen, because a user has to stake in order to unstake, and you can neither stake nor unstake an amount of zero.

Zellic © 2024Back to top ↑