Submission Details
Severity:
Startime can be a time in the past.
Vulnerability Details
In the Helpers.sol:checkCreateLockupLinear there is not checks to ensure that the start time is a time in the future. The check only ensures that start time > 0.
This can lead to a suition where a huge portion of the funds are available.
function checkCreateLockupLinear(uint128 depositAmount, LockupLinear.Timestamps memory timestamps) internal view {
// Check: the deposit amount is not zero.
if (depositAmount == 0) {
revert Errors.SablierV2Lockup_DepositAmountZero();
}
// Check: the start time is not zero.
@-> if (timestamps.start == 0) {
revert Errors.SablierV2Lockup_StartTimeZero();
}
// Since a cliff time of zero means there is no cliff, the following checks are performed only if it's not zero.
if (timestamps.cliff > 0) {
// Check: the start time is strictly less than the cliff time.
if (timestamps.start >= timestamps.cliff) {
revert Errors.SablierV2LockupLinear_StartTimeNotLessThanCliffTime(timestamps.start, timestamps.cliff);
}
// Check: the cliff time is strictly less than the end time.
if (timestamps.cliff >= timestamps.end) {
revert Errors.SablierV2LockupLinear_CliffTimeNotLessThanEndTime(timestamps.cliff, timestamps.end);
}
}
// Check: the start time is strictly less than the end time.
if (timestamps.start >= timestamps.end) {
revert Errors.SablierV2LockupLinear_StartTimeNotLessThanEndTime(timestamps.start, timestamps.end);
}
// Check: the end time is in the future.
uint40 blockTimestamp = uint40(block.timestamp);
if (blockTimestamp >= timestamps.end) {
revert Errors.SablierV2Lockup_EndTimeNotInTheFuture(blockTimestamp, timestamps.end);
}
}
Impact
Alot of funds with be available to the reciepient without any passage of time.
Tools Used
Manual
Recommendations
Add checks to ensure that start time is greater than the current block timestamp.
Updates
Prize pool breakdown
Total prize
53,440 USDC
nSLOC
2,65520 USDC / LOC
45,000 USDC
3,100 USDC
5,340 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.