Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing check for segment/tranches amount

holydevoti0n

Summary

The Helpers library is used to validate the inputs when creating a stream. The problem is that two functions from this library doesn't check for the segment/tranches amount(which should be done when creating a stream):

Specifically _checkTranches and _checkSegments.

uint256 count = segments.length;
for (uint256 index = 0; index < count; ++index) {
// Add the current segment amount to the sum.
@> segmentAmountsSum += segments[index].amount; // @audit no amount validation. zero will pass.
​
​
// Check: the current timestamp is strictly greater than the previous timestamp.
currentSegmentTimestamp = segments[index].timestamp;
if (currentSegmentTimestamp <= previousSegmentTimestamp) {
revert Errors.SablierV2LockupDynamic_SegmentTimestampsNotOrdered(
index, previousSegmentTimestamp, currentSegmentTimestamp
);
}
for (uint256 index = 0; index < count; ++index) {
// Add the current tranche amount to the sum.
@> trancheAmountsSum += tranches[index].amount; // @audit tranches with no amount validation. zero will pass.
​
​
// Check: the current timestamp is strictly greater than the previous timestamp.
currentTrancheTimestamp = tranches[index].timestamp;
if (currentTrancheTimestamp <= previousTrancheTimestamp) {
revert Errors.SablierV2LockupTranched_TrancheTimestampsNotOrdered(
index, previousTrancheTimestamp, currentTrancheTimestamp
);
}

Vulnerability Details

By creating several segments or tranches with 0 amount and then only one with a fractional value (such as 1 wei), attackers can bypass checks that ensure the total amount is not zero. This can result in the system processing and accepting streams that should otherwise be invalid.

Impact

  • Attackers can in a cheap way overload the smart contract with thousands of entries using a fractional value for deposit as zero amount is accepted. As long as there is one entry with a minimum value, stream creation will succeed.

  • System will be flooded with thousands/millions of invalid segments/tranches.

  • The smart contract may run out of gas while processing entries, further exacerbating the DoS condition. This can be particularly problematic in scenarios where the contract needs to handle large volumes of transactions, as it will be unable to do so efficiently.

Tools Used

Manual Review

Recommendations

  • Do not accept segments/tranches with zero value.

_checkSegments:

if (segments[index].amount == 0) revert Errors.SablierV2Lockup_SegmentDepositAmountZero();

_checkTranches:

if (tranches[index].amount == 0) revert Errors.SablierV2Lockup_TrancheDepositAmountZero();

  • (Additional) Consider adding a minimum value for deposit.

Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.