Zellic - Audit Reports

Assessment reports Public findings

Back to Zellic site

Assessment reports>Aura Finance>Threat Models>Function: lock(uint256 _cvxAmount)

GeneralOverview

DiscussionThe protectAddPool is unsafe Withdrawal of funds from a shut down pool

Threat ModelsWhat are threat models?AuraBalProxyOFT.sol AuraBalRewardPool.sol

AuraOFT.sol Function: lock(uint256 _cvxAmount)

AuraVestedEscrow.sol BaseRewardPool4626.sol BoosterLite.sol ExtraRewardsDistributor.sol L1Coordinator.sol PausableOFT.sol PausableProxyOFT.sol PoolManagerLite.sol VirtualBalanceRewardPool.sol

Audit ResultsAudit Results

Function: `lock(uint256 _cvxAmount)`

Lock the OFT tokens of the _canonicalChainId.

Inputs

_cvxAmount
- Control: Full control.
- Constraints: msg.sender should have more or an equal amount of tokens.
- Impact: The amount of tokens will be transferred to another chain.

Branches and code coverage (including function calls)

Intended branches

The balance of msg.sender was decreased by _cvxAmount.
Test coverage
The totalSupply was increased by _cvxAmount
Test coverage

Negative behavior

msg.sender does not have enough tokens.
Negative test
_cvxAmount == 0.
Negative test
without fee
Negative test

Function call analysis

_debitFrom(msg.sender, canonicalChainId, bytes(""), _cvxAmount) -> _debitFrom -> _burn(_from, _amount)
- External/internal? Internal.
- Argument control? _cvxAmount
- Impact Burn the _cvxAmount amount of tokens from the msg.sender balance before transfer to the canonicalChainId.

Zellic © 2025Back to top ↑