Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Burned streams remain active

holydevoti0n

Summary

When burning a streamId(NFT), the system checks whether the stream is valid through the modifier notNull which verifies the dictionary with that streamId and checks whether the property isStream is true.

The problem is that this variable is not updated when the NFT is burned. This means that users will still receive in their UI when fetching the streams that the burned streamId is still active. Then when trying to burn it again the transaction will revert with the following error SablierV2Lockup_Unauthorized.

function burn(uint256 streamId) external override noDelegateCall notNull(streamId) {
// Check: only depleted streams can be burned.
if (!_streams[streamId].isDepleted) {
revert Errors.SablierV2Lockup_StreamNotDepleted(streamId);
}
​
​
// Check:
// 1. NFT exists (see {IERC721.getApproved}).
// 2. `msg.sender` is either the owner of the NFT or an approved third party.
if (!_isCallerStreamRecipientOrApproved(streamId)) {
revert Errors.SablierV2Lockup_Unauthorized(streamId, msg.sender);
}
​
​
// Effect: burn the NFT.
_burn({ tokenId: streamId });
}

As the streamId has been previously burned, now it belongs to the address zero, but yet it still passes on the modifier notNull as isStream is yet true.

Tools Used

Manual Review

Recommendations

In the function burn make sure to update the stream state by setting the isStream property to false.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

holydevoti0n Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
holydevoti0n Submitter
about 1 year ago
0xnevi Judge
about 1 year ago
golanger85 Auditor
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.