Skip to content

Conversation

@aalavandhan
Copy link
Member

@aalavandhan aalavandhan commented Apr 18, 2023

  • Public method to recover individual assets.
  • Cleaned up internal book-keeping of deployed list. Created separate methods to add and remove assets.
  • Using <= 0 instead of == 0
  • Added some unit tests to improve coverage

Though this helps guard against the _deployed list growing indefinitely. It opens up the surface area of attack if we don't restrict the assets which can be recovered. Example, malicious user can transfer a fake tranche into the system and call recover with the fake tranche address. This adds the tranche into the deployed list. Now the malicious user can fudge the vault's valuation function to drain funds.

We should only allow the user to "recover" vault assets which are already in the deployed list, which we can safely assume to be tranches issued by the whitelisted bond issuer.

@aalavandhan aalavandhan added the next-release Changes for upcoming release label Apr 18, 2023
@aalavandhan aalavandhan changed the title Individual redemption Individual recovery Apr 18, 2023
@aalavandhan aalavandhan force-pushed the redeem-flow branch 3 times, most recently from f763082 to 2d03a81 Compare April 19, 2023 15:08
Copy link
Member

@brandoniles brandoniles left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@aalavandhan aalavandhan merged commit 084a78f into main Apr 28, 2023
@aalavandhan aalavandhan deleted the redeem-flow branch April 28, 2023 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

next-release Changes for upcoming release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants