Submission Details
Severity:
SablierV2Lockup : notNull(streamId) is missing for `getRecipient`
Summary
The check stream exists or not is not validated when calling the getRecipient function.
Vulnerability Details
function getEndTime(uint256 streamId) external view override notNull(streamId) returns (uint40 endTime) { --->> @@audit find - check present
endTime = _streams[streamId].endTime;
}
/// @inheritdoc ISablierV2Lockup
function getRecipient(uint256 streamId) external view override returns (address recipient) { -------->>@@ audit find - check absent
// Check the stream NFT exists and return the owner, which is the stream's recipient.
recipient = _requireOwned({ tokenId: streamId });
}
Impact
When the getRecipient is used front end application, it would lead to unexpected issues.
Tools Used
Manual review.
Recommendations
make sure to add the notNull(streamId) modifier for getRecipient function as well.
Updates
Prize pool breakdown
Total prize
53,440 USDC
nSLOC
2,65520 USDC / LOC
45,000 USDC
3,100 USDC
5,340 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.