Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>WOOFI Stake>Threat Model>endWeeklySettle
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionInstant withdraw cap can be bypassedSimilarities to ERC-4626 first-deposit issueSlippage check not performed during compoundReward function
Threat ModelWhat are threat models?BaseStrategy.solStrategyAave.solVaultV2.solWooLendingManager.solWooStakingCompounder.solWooStakingController.solWooStakingLocal.solWooStakingManager.solWooStakingProxy.sol
WooSuperChargerVaultV2.soldepositendWeeklySettleinCaseTokenGotStuckinstantWithdrawmigrateReserveVaultmigrateToNewVaultrequestWithdraw
WooWithdrawManagerV2.sol
Audit ResultsAssessment Results

Function: endWeeklySettle()

This performs the weekly settlement for the vault.

Branches and code coverage

Intended branches

  • Should not be able to DOS by adding small requests. This should be enforced via maxWithdrawCount from the requestWithdraw function.

  • Ensure that it is in the settling phase.

  • Ensure that the weekly repay is cleared.

  • Set the settling flag to false.

  • If there is a total withdraw amount, withdraw it from the reserve vault.

  • If the want is WETH, deposit the total withdraw amount.

  • Ensure that the available balance is enough for the total withdraw amount.

  • Iterate over all the users and add the withdraw amount to the withdraw manager.

  • Reset the requested withdraw shares and deplete the users' requests array.

  • Remove the users from the request users set.

  • Burn the total collected shares.

  • Reset the total requested shares.

  • Transfer the total withdraw amount to the withdraw manager.

  • Accrue the interest.

  • Update the instantWithdrawCap to 10% of the total balance.

Negative behavior

  • Should not be callable by anyone other than the admin.

Zellic © 2024Back to top ↑