Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>WOOFI Stake>Threat Model>inCaseTokenGotStuck
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionInstant withdraw cap can be bypassedSimilarities to ERC-4626 first-deposit issueSlippage check not performed during compoundReward function
Threat ModelWhat are threat models?BaseStrategy.solStrategyAave.solVaultV2.solWooLendingManager.solWooStakingCompounder.solWooStakingController.solWooStakingLocal.solWooStakingManager.sol
WooStakingProxy.solcompoundAllcompoundMPemergencyUnstakeinCaseTokenGotStucksetAutoCompoundstakestakeunstakeunstakeAll
WooSuperChargerVaultV2.solWooWithdrawManagerV2.sol
Audit ResultsAssessment Results

Function: inCaseTokenGotStuck(address stuckToken)

This allows the owner to recover any token sent to the contract by mistake.

Inputs

  • stuckToken

    • Control: Fully controlled by the owner.

    • Constraints: Checked to be either native or some ERC-20 token.

    • Impact: The token to be recovered.

Branches and code coverage

Intended branches

  • Called by owner to retrieve stuck native tokens.

  • Called by owner to retrieve stuck ERC-20 tokens.

Negative behavior

  • Should not be callable by anyone other than the owner.

Zellic © 2024Back to top ↑