Stream's sender or an approved third party can call the withdraw
function to withdraw the stream's balance.
This action triggers the onStreamWithdrawn function.
However, the onStreamWithdrawn
function doesn't have any logic to unstake the vested FJORD tokens.
https://github.com/Cyfrin/2024-08-fjord/blob/main/src/FjordStaking.sol#L792
The absence of implementation in the onStreamWithdrawn function means the contract does not handle the vested FJORD tokens properly.
Manual review
Implement the logic to unstake the vested FJORD tokens in the onStreamWithdrawn function.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.