Assessment reports>Y2K Finance>Threat Model>setStrategyVault

Function: setStrategyVault(address _strategy, address _borrowToken, address _lpToken)

This sets the strategy vault info.

Inputs

  • _strategy

    • Control: Fully controlled.

    • Constraints: Must not be the zero address.

    • Impact: The address of the strategy vault.

  • _borrowToken

    • Control: Fully controlled.

    • Constraints: Must not be the zero address.

    • Impact: The address of the borrow token.

  • _lpToken

    • Control: Fully controlled.

    • Constraints: Must not be the zero address.

    • Impact: The address of the LP token.

Branches and code coverage (including function calls)

Intended branches

  • The global storage variables strategyInUse, strategyDepositToken, strategyBorrowToken, and strategyLPToken are updated properly.

Negative behavior

  • The function reverts if _strategy, _borrowToken, or _lpToken is the zero address.

Function call analysis

  • ERC20 _depositToken = IStrategyVault(_strategy).asset();

    • What is controllable? _strategy.

    • If return value controllable, how is it used and how can it go wrong? The return value is assigned to _depositToken, and its use is not controllable. The function is used to retrieve the asset of the strategy vault.

    • What happens if it reverts, reenters, or does other unusual control flow? If this reverts, it indicates that _strategy is not a valid strategy vault contract.

Zellic © 2024Back to top ↑