Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>WOOFI Stake>Threat Model>emergencyUnstake
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionInstant withdraw cap can be bypassedSimilarities to ERC-4626 first-deposit issueSlippage check not performed during compoundReward function
Threat ModelWhat are threat models?BaseStrategy.solStrategyAave.solVaultV2.solWooLendingManager.solWooStakingCompounder.solWooStakingController.solWooStakingLocal.solWooStakingManager.sol
WooStakingProxy.solcompoundAllcompoundMPemergencyUnstakeinCaseTokenGotStucksetAutoCompoundstakestakeunstakeunstakeAll
WooSuperChargerVaultV2.solWooWithdrawManagerV2.sol
Audit ResultsAssessment Results

Function: emergencyUnstake()

This unstakes the entire balance of the sender. Can only be used in emergencies. Does not produce LZ events.

Branches and code coverage

Intended branches

  • Called during an emergency.

Negative behavior

  • Called when there is no emergency.

Zellic © 2025Back to top ↑