Assessment reports>Y2K Finance>Threat Model>_withdrawFromVault

Function: _withdrawFromVault(uint256 id, uint256 assets, address receiver, address vaultAddress)

This withdraws from the vault.

Inputs

  • id

    • Constraints: Should be the correct epoch ID for the Y2K vault.

    • Impact: The epoch ID for the Y2K vault.

  • assets

    • Constraints: No constraints.

    • Impact: The amount of the token to withdraw.

  • receiver

    • Constraints: No constraints.

    • Impact: The address to receive the withdrawn tokens.

  • vaultAddress

    • Constraints: Should be a valid vault address.

    • Impact: The address of the vault to withdraw from.

Branches and code coverage (including function calls)

Intended branches

  • The function calls the withdraw function of the IEarthquake contract to initiate the withdrawal.

Negative behavior

  • The function reverts if the withdraw function call fails.

Function call analysis

  • IEarthquake(vaultAddress).withdraw(id, assets, receiver, address(this))

    • What is controllable? id, assets, receiver, and vaultAddress.

    • If return value controllable, how is it used and how can it go wrong? This function call returns the actual amount of assets withdrawn.

    • What happens if it reverts, reenters, or does other unusual control flow? If the withdrawal fails, it will revert and the transaction will be rolled back --- no reentrancy scenarios.

Zellic © 2024Back to top ↑