mirror of
https://github.com/luxfi/liquid.git
synced 2026-10-30 16:21:07 +00:00
zeekay
79a1e7a7e0
F-01 CRITICAL: LiquidTokenVault unchecked ERC20 transfers - use TokenUtils.safeTransfer/safeTransferFrom F-02 CRITICAL: LiquidAllocator cap bypass via type(uint256).max - add configurable maxAllocationPerStrategy F-03 CRITICAL: SfrxETH sends tokens to address(0) - require dexRouter to be set, revert if not configured F-04 CRITICAL: LiquidGauge registerNewStrategy empty - implement with admin access control F-05 HIGH: Liquid.sol missing reentrancy guard - add ReentrancyGuardUpgradeable to all state-changing externals F-06 HIGH: LiquidGauge flash loan voting - snapshot voterPower at vote time instead of reading balanceOf F-08 HIGH: LiquidGauge executeAllocation no access control - require admin or keeper F-12 MEDIUM: Remove forge-std console.log imports from Liquid, LiquidTransmuter, LiquidStrategy
54 lines
1.8 KiB
Solidity
54 lines
1.8 KiB
Solidity
// SPDX-License-Identifier: MIT
|
|
pragma solidity 0.8.28;
|
|
|
|
import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
|
|
import {TokenUtils} from "./libraries/TokenUtils.sol";
|
|
import "./base/Errors.sol";
|
|
import "./adapters/AbstractFeeVault.sol";
|
|
|
|
/**
|
|
* @title LiquidTokenVault
|
|
* @notice A vault that holds a specific ERC20 token, allowing anyone to deposit
|
|
* but only authorized parties to withdraw.
|
|
*/
|
|
contract LiquidTokenVault is AbstractFeeVault {
|
|
/**
|
|
* @notice Constructor initializes the token vault
|
|
* @param _token The ERC20 token managed by this vault
|
|
* @param _liquid The Liquid contract address that will be authorized
|
|
* @param _owner The owner of the vault
|
|
*/
|
|
constructor(address _token, address _liquid, address _owner) AbstractFeeVault(_token, _liquid, _owner) {}
|
|
|
|
/**
|
|
* @notice Allows anyone to deposit tokens into the vault
|
|
* @param amount The amount of tokens to deposit
|
|
*/
|
|
function deposit(uint256 amount) external {
|
|
_checkNonZeroAmount(amount);
|
|
TokenUtils.safeTransferFrom(token, msg.sender, address(this), amount);
|
|
emit Deposited(msg.sender, amount);
|
|
}
|
|
|
|
/**
|
|
* @notice Allows only authorized accounts to withdraw tokens
|
|
* @param recipient The address to receive the tokens
|
|
* @param amount The amount of tokens to withdraw
|
|
*/
|
|
function withdraw(address recipient, uint256 amount) external override onlyAuthorized {
|
|
_checkNonZeroAddress(recipient);
|
|
_checkNonZeroAmount(amount);
|
|
|
|
TokenUtils.safeTransfer(token, recipient, amount);
|
|
emit Withdrawn(recipient, amount);
|
|
}
|
|
|
|
/**
|
|
* @notice Get the total deposits in the vault
|
|
* @return Total deposits
|
|
*/
|
|
function totalDeposits() public view override returns (uint256) {
|
|
return IERC20(token).balanceOf(address(this));
|
|
}
|
|
}
|