The sender address is not validated anywhere, which can prevent the calling of cancel and renounce functions.
Vulnerability details
Unlike the recipient address, which if set to zero will prevent streams from being created, so validating it is not necessary, the sender address is not validated anywhere while creating streams. If the sender address is set to the zero address, then nobody can cancel or renounce the stream.
This issue is possible if the sender and funder are two different addresses.
Impact
In these cases, cancelling and renouncing the streams will not be possible.
Tools Used
Manual Review
Recommended Mitigation Steps
Validate the sender address if the sender is different from the funder.
Lead Judging Commences
Info/Gas/Invalid as per Docs
https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.