Summary

The contract lacks proper checks to ensure that sensitive operations are only performed by authorized parties, potentially allowing unauthorized access and manipulation of stream data.

Vulnerability Details

The withdraw function (lines 417-444) allows any address to withdraw funds from a stream without proper authorization checks:

his function only checks if the to address is not zero (line 785) and if the withdrawal amount is not zero (line 780). However, it does not verify if the caller is the stream recipient or has approval to withdraw funds.

Impact

The lack of proper access control in the withdraw function and related internal functions could lead to:

1. Unauthorized withdrawals: Any address could potentially withdraw funds from any stream, regardless of their relationship to the stream.

2. Stream manipulation: Malicious actors could modify stream parameters without authorization.

3. Loss of funds: Stream recipients could lose their funds to unauthorized withdrawals.

Tools Used

manual analysis

Recommendations

Implement proper access control for the withdraw function:

• Add a check to ensure the caller is either the stream recipient or has approval.

• Consider implementing a more granular permission system.