Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`stream` owner should be able to specify `to` parameter in `withdrawMaxAndTransfer()` function

zark

Summary

stream owner is not able to withdrawMax in whichever address he wants due to hard coded address parameter in withdrawMaxAndTransfer() function.

Vulnerability Details

A stream owner can call withdrawMaxAndTransfer() function when we wants to withdraw the funds he has accumulate and also transfer the stream in the same address. However, since he the owner of the stream, he has the option according to natsec to withdraw the money to whichever address he wants. In withdrawMaxAndTransfer(), it is hardcoded so to he is the one receiving the money falsely.

function withdrawMaxAndTransfer(
uint256 streamId,
address newRecipient
)
// ...
{
// ...
​
// Skip the withdrawal if the withdrawable amount is zero.
uint128 withdrawableAmount = _withdrawableAmountOf(streamId);
if (withdrawableAmount > 0) {
withdraw({ streamId: streamId, to: currentRecipient, amount: withdrawableAmount });
}
​
// ...
}

Link to code

Tools Used

Manual review

Recommendations

Consider adding a to parameter to withdrawMaxAndTransfer() function so the stream owner can specify the address he wants to transfer the stream to :

function withdrawMaxAndTransfer(
uint256 streamId,
+ address to,
address newRecipient
)
external
override
noDelegateCall
notNull(streamId)
{
// Check: the caller is the current recipient. This also checks that the NFT was not burned.
address currentRecipient = _ownerOf(streamId);
if (msg.sender != currentRecipient) {
revert Errors.SablierV2Lockup_Unauthorized(streamId, msg.sender);
}
​
// Skip the withdrawal if the withdrawable amount is zero.
uint128 withdrawableAmount = _withdrawableAmountOf(streamId);
if (withdrawableAmount > 0) {
- withdraw({ streamId: streamId, to: currentRecipient, amount: withdrawableAmount });
+ withdraw({ streamId: streamId, to: to, amount: withdrawableAmount });
}
​
// Checks and Effects: transfer the NFT.
_transfer({ from: currentRecipient, to: newRecipient, tokenId: streamId });
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.