Flow

Summary

The protocol allows 2 ways of depositing tokens to a stream: the deposit function and the depositViaBroker function. The latter charges a broker fee, but this is not enforced anywhere. So users can define their own parameters and skip fees.

Vulnerability Details

The depositViaBroker takes in the broker details from the user themselves.

So users can send in a broker with its broker.fee=0 and skip paying any fees. Furthermore, users can also deposit directly via the deposit function, skipping paying any brokerage fees. So users can participate in the system while skipping the brokerage fees since they are not enforced at all in the contract level.

Impact

Broker can be left unpaid.

Tools Used

Manual

Recommendations

Consider allowing the creator of the stream to define a broker. This way contributors to that stream must pay a mandatory brokerage fee to that account defined in the stream.