Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

vFJO-Stakers wont be able stake if the stream is `uncancelable`.

maushishreal

Summary

vFJO-Stakers are not able to stake even if the stream is uncancellable which is against the intended design.

Vulnerability Details

Flow of stakeVested() checks regarding streams :

  1. Check if the stream is valid or not

  2. If the stream is valid check if it's not a cold stream.

  3. If its a cold stream revert

  4. If the status is Cancelable, Authorized Sablier IDs should be able to stake.

The problem lies in step 4, as the current implementation only allows Authorized Sablier IDs to stake using stakedVested() even if the stream is non-cancellable

function stakeVested(uint256 _streamID) external checkEpochRollover redeemPendingRewards {
//CHECK
if (!sablier.isStream(_streamID)) revert NotAStream();
if (sablier.isCold(_streamID)) revert NotAWarmStream();
​
// only allow authorized stream sender to stake cancelable stream
if (!authorizedSablierSenders[sablier.getSender(_streamID)]) { //-----------ISSUE-------------//
revert StreamNotSupported();
}
if (address(sablier.getAsset(_streamID)) != address(fjordToken)) revert InvalidAsset();
​
...
}
​

Impact

Sablier IDs that are not unauthorized won't be able to stake when the stream is non-cancellable.

Tools Used

Manual Review

Recommendations

  • Implement a status check to make sure if it's a cancellable stream then only Authorized Sablier IDs can pass.

+ if (sablier.isCancelable(_streamID)) {
+ if (!authorizedSablierSenders[sablier.getSender(_streamID)]) {
+ revert StreamNotSupported();
+ }
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

maushishreal Submitter
10 months ago
inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.