Sablier

Summary

The _calculateStreamedAmount function in the SablierV2Lockup contract calculates the streamed amount by summing the amounts in all vested tranches. However, the function currently assumes that there is at least one tranche in the tranches array. If the tranches array is empty, accessing tranches[0] will result in an out-of-bounds error, which can cause the function to fail.

Vulnerability Details

The function does not check if the tranches array is empty before accessing the first element (tranches[0]). If the tranches array is empty, attempting to access tranches[0] will result in an out-of-bounds error, causing the function to revert. This issue arises because the function assumes that there is at least one tranche in the array, which may not always be the case.

Impact

An out-of-bounds error due to accessing an empty tranches array can cause the function to revert, potentially disrupting the contract's functionality. This vulnerability can lead to the following impacts:

Disruption of normal contract operations, causing functions to fail unexpectedly.
Inability to correctly calculate the streamed amount for certain streams.
Potential denial of service if the function is called in critical operations.

Tools Used

Recommendations

To mitigate this vulnerability, add a check at the beginning of the function to ensure the tranches array is not empty before accessing its elements. Here is the recommended fix: