Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>WOOFI Stake>Threat Model>deposit
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionInstant withdraw cap can be bypassedSimilarities to ERC-4626 first-deposit issueSlippage check not performed during compoundReward function
Threat ModelWhat are threat models?BaseStrategy.solStrategyAave.solVaultV2.solWooLendingManager.solWooStakingCompounder.solWooStakingController.solWooStakingLocal.solWooStakingManager.solWooStakingProxy.sol
WooSuperChargerVaultV2.soldepositendWeeklySettleinCaseTokenGotStuckinstantWithdrawmigrateReserveVaultmigrateToNewVaultrequestWithdraw
WooWithdrawManagerV2.sol
Audit ResultsAssessment Results

Function: deposit(uint256 amount)

This allows depositing in the SuperChargerVault.

Inputs

  • amount

    • Control: Fully controlled.

    • Constraints: User needs to afford amount tokens.

    • Impact: The amount of tokens to deposit.

Branches and code coverage

Intended branches

  • Ensure that the deposit amount is greater than 10 so that the instantWithdrawCap is updated properly.

  • Accrue interest in the lending manager.

  • Calculate the amount of shares to mint.

  • Update the cost share price of the receiver.

  • If want == weth, deposit the amount as native tokens in the reserve vault.

  • If want != weth, transfer the amount as ERC-20 tokens to the reserve vault.

  • Mint the adequate amount of shares to the receiver.

  • Update the instant withdraw cap.

Negative behavior

  • Should not allow depositing an amount that is not afforded by the user.

Zellic © 2025Back to top ↑