Sablier

Description

When someone needs to withdraw from multiple streams, they can easily do so by calling withdrawMultiple. The user specifies the amounts to withdraw and the corresponding stream IDs. This feature is particularly useful when a user creates a batch of streams and wants to withdraw them to the respective recipients, due to the nature of batch streams this is super convenient.

However, a malicious user can easily call withdraw on just one of the many streamIds[] that the user is attempting to withdraw from, specifying a small amount. This is feasible because anyone can call withdraw upon a recipient.

This is further confirmed by the protocol itself, as stated in the documentation:

With all of this in mind, the following scenario will be played out:

• Let's say a user calls withdrawMultiple with an array containing hundreds of streamIds (which is plausible due to the nature of batch streams).

• The user aims to withdraw the maximum amount from all streamIds.

• For example, streamId(1) holds 50 tokens, and the user specifies amount = 50 for streamId(1).

• A malicious user observes this and frontruns this by calling withdraw, specifying streamId(1) and amount = 1.

• Consequently, the available amount that can be withdrawn from streamId(1) changes to 50 - 1 = 49.

• withdrawMultiple function fails.

Sponsor also confirmed this is an issue per discord:

This can be done by anyone, to anyone.

Certainly, there's a function named withdrawMax, which utilizes the _withdrawableAmountOf instead of a specified amount. This function cannot be frontran. However, it's impractical to expect a user to call this function hundreds of times when dealing with a batch.

Tools Used

Manual Review

Recommendation

Introduce a withdrawMaxMultiple function with the logic of withdrawMax, or do not allow anyone to call withdraw functions.