Submission Details
Severity:
Protocol withdraw function access-control is incorrect
Summary
Protocol withdraw function access-control is incorrect.
Vulnerability Details
According the sablier doc access-control when call withdraw action:
- Both the recipient and the NFT operator have the option to specify a custom address to withdraw the assets to.
- The sender, however, is limited to withdrawing assets directly to the recipient's address.
But the protocol don't implement the function correctly:
function withdraw(
uint256 streamId,
address to,
uint128 amount
) {
...
if (to != recipient && !_isCallerStreamRecipientOrApproved(streamId)) {
revert Errors.SablierV2Lockup_WithdrawalAddressNotRecipient(streamId, msg.sender, to);
}
...
}
When the msg.sender isn't sender, recipient or an approved operator, he also can withdraw the stream asset to recipient, which don't implement such function correctly.
Impact
Any users can withdraw the stream assets to recipient.
Tools Used
vscode, Manual Review
Recommendations
Limit only the sender can withdraw the stream to recipient.
Prize pool breakdown
Total prize
53,440 USDC
nSLOC
2,65520 USDC / LOC
45,000 USDC
3,100 USDC
5,340 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.