Assessment reports>Y2K Finance>Threat Model>claimRefund

Function: claimRefund(address token, address sender)

This allows to claim a refund for the original sender and token. The eligibleRefund[sender][token] should not be zero. The eligibleRefund is set if the sgReceive function has failed.

Inputs

  • token

    • Constraints: eligibleRefund[sender][token] != 0.

    • Impact: The address of tokens that will be refunded.

  • sender

    • Constraints: eligibleRefund[sender][token] != 0.

    • Impact: The receiver of token refund.

Branches and code coverage (including function calls)

Intended branches

  • Refund is performed properly for token == sgEth.

  • Refund is performed properly for token != sgEth.

Negative behavior

  • eligibleRefund[sender][token] == 0 for msg.sender.

  • Repeated function call after successful refund.

Function call analysis

  • _claimRefund -> payable(sender).call{value: amount}("");

    • What is controllable? N/A.

    • If return value controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters, or does other unusual control flow? Can reenter but without negative impact.

  • _claimRefund -> ERC20(token).safeTransfer(sender, amount)

    • What is controllable? N/A.

    • If return value controllable, how is it used and how can it go wrong? N/A.

    • What happens if it reverts, reenters, or does other unusual control flow? Can reenter but without negative impact.

Zellic © 2024Back to top ↑