Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

NFTs can be transferred even if it is not transferable with the `withdrawMaxAndTransfer()` function.

oxtenma

Summary

NFTs can be transferred even if it is not transferable with the withdrawMaxAndTransfer() function.

Vulnerability Details

The function withdrawMaxAndTransfer() withdraws the maximum withdrawable amount from the stream and transfers the NFT to newRecipient.

function withdrawMaxAndTransfer(
uint256 streamId,
address newRecipient
)
external
override
noDelegateCall
notNull(streamId)
{
// Check: the caller is the current recipient. This also checks that the NFT was not burned.
address currentRecipient = _ownerOf(streamId);
if (msg.sender != currentRecipient) {
revert Errors.SablierV2Lockup_Unauthorized(streamId, msg.sender);
}
​
// Skip the withdrawal if the withdrawable amount is zero.
uint128 withdrawableAmount = _withdrawableAmountOf(streamId);
if (withdrawableAmount > 0) {
withdraw({ streamId: streamId, to: currentRecipient, amount: withdrawableAmount });
}
​
// Checks and Effects: transfer the NFT.
_transfer({ from: currentRecipient, to: newRecipient, tokenId: streamId });
// @audit issue
}

The issue is the that the function doesn't check whether the NFT is transferrable or not with calling the function isTransferable() before transferring it. The isTransferable() retrieves a flag indicating whether the stream NFT can be transferred.

function isTransferable(uint256 streamId) external view override notNull(streamId) returns (bool result) {
result = _streams[streamId].isTransferable;
}
​

Impact

Anyone can transfer his stream NFT even it is flagged as isTransferable = false when creating the stream.

Tools Used

Manual Review

Recommendations

Add the check to verify the NFT is transferable or not by calling the function isTransferable().

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.