Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Aura Finance>Threat Models>Function: rescue(address _token, address _to, uint256 _amount)
GeneralOverview
DiscussionThe protectAddPool is unsafeWithdrawal of funds from a shut down pool
Threat ModelsWhat are threat models?AuraBalProxyOFT.solAuraBalRewardPool.solAuraOFT.solAuraVestedEscrow.solBaseRewardPool4626.solBoosterLite.solExtraRewardsDistributor.solL1Coordinator.solPausableOFT.sol
PausableProxyOFT.solFunction: processQueued(uint256 _epoch, uint16 _srcChainId, address _to, uint256 _amount, uint256 _timestamp)Function: rescue(address _token, address _to, uint256 _amount)Function: sendFrom(address _from, uint16 _dstChainId, byte[] _toAddress, uint256 _amount, address payable _refundAddress, address _zroPaymentAddress, byte[] _adapterParams)
PoolManagerLite.solVirtualBalanceRewardPool.sol
Audit ResultsAudit Results

Function: rescue(address _token, address _to, uint256 _amount)

The sudo address can transfer any tokens from the current contract to an arbitrary recipient. The sudo is set during deploy and cannot be changed.

Zellic © 2025Back to top ↑