Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

SablierV2Lockup : An Approved operator can not do the `withdrawMaxAndTransfer`

ak1

Summary

The stream NFT can not be transferred by the approved operator. Since the function expects the NFT owner should be the caller.

Vulnerability Details

NFT transfer or other related functions can be done either by the owner of the NFT or the user who was deleagted by the NFT owner.

In this case, when third party operator does operation on behalf of the NFT owner.

In Sablier, the withdraw can be called by the approved operator. this is to enable for any third party operation.

But the function withdrawMaxAndTransfer expects that the caller should be the NFT owner.

SablierV2Lockup.sol#L410-L433

function withdrawMaxAndTransfer(
uint256 streamId,
address newRecipient
)
external
override
noDelegateCall
notNull(streamId)
{
// Check: the caller is the current recipient. This also checks that the NFT was not burned.
address currentRecipient = _ownerOf(streamId);
if (msg.sender != currentRecipient) {
revert Errors.SablierV2Lockup_Unauthorized(streamId, msg.sender);
}
​
// Skip the withdrawal if the withdrawable amount is zero.
uint128 withdrawableAmount = _withdrawableAmountOf(streamId);
if (withdrawableAmount > 0) {
withdraw({ streamId: streamId, to: currentRecipient, amount: withdrawableAmount });
}
​
// Checks and Effects: transfer the NFT.
_transfer({ from: currentRecipient, to: newRecipient, tokenId: streamId });
}

Impact

Approved operator can not do the operation on behalf of the NFT owner. This will raise issue when NFT transfers across markets.

Tools Used

Manual review.

Recommendations

We would suggest to refractor the withdrawMaxAndTransfer so that the approved user can call this.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

ak1 Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.