Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The callback function should be called within the `withdraw` function when the `msg.sender` is the `recipient`.

ethersky

Vulnerability Details

The recipient can have an onLockupStreamWithdrawn function to be notified of withdrawals.
This function may contain important logic that needs to be executed based on the new withdrawals.

Currently, we do not invoke this callback function when the msg.sender is the recipient.

function withdraw() {
if (msg.sender != recipient && recipient.code.length > 0) {
try ISablierV2Recipient(recipient).onLockupStreamWithdrawn({
streamId: streamId,
caller: msg.sender,
to: to,
amount: amount
}) { } catch { }
}
}

However, the recipient still wants the consequent logic in the callback function to be executed when they withdraw funds.
Right now, the recipient must perform a second transaction to execute this logic, which is inefficient.

Therefore, we should modify the system to always invoke the onLockupStreamWithdrawn function when a withdrawal occurs, whether the msg.sender is the recipient or the sender of the stream.
This change ensures that the necessary logic is executed in all cases without requiring additional transactions.

Tools Used

Manual

Recommendations

function withdraw() {
- if (msg.sender != recipient && recipient.code.length > 0) {
+ if (recipient.code.length > 0) {
try ISablierV2Recipient(recipient).onLockupStreamWithdrawn({
streamId: streamId,
caller: msg.sender,
to: to,
amount: amount
}) { } catch { }
}
​
- if (msg.sender != sender && sender.code.length > 0 && sender != recipient) {
+ if (sender.code.length > 0 && sender != recipient) {
try ISablierV2Sender(sender).onLockupStreamWithdrawn({
streamId: streamId,
caller: msg.sender,
to: to,
amount: amount
}) { } catch { }
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.