Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

There was an error when triggering the BatchMetadataUpdate event

bydlife

Summary

There is an error in the event BatchMetadataUpdate triggered during the execution of SablierFlowBase.sol::setNFTDescriptor() and SablierFlowBase.sol::setProtocolFee().

Vulnerability Details

If the NFT has not been created, _toTokenId is 0. If the project monitors this event, it is likely to cause some unnecessary errors.

The specific details are that the value of nextStreamId is 1 at the beginning. If the setProtocolFee() or setNFTDescriptor() function is executed when the SablierFlow is not created, the event BatchMetadataUpdate(1,0) will be triggered. This is obviously ambiguous. Normally, the TokenId of batch updates should be incremented. If there is an external program listening to this event, it may cause unpredictable harm.

function setNFTDescriptor(IFlowNFTDescriptor newNFTDescriptor) external override onlyAdmin {
// Effect: set the NFT descriptor.
IFlowNFTDescriptor oldNftDescriptor = nftDescriptor;
nftDescriptor = newNFTDescriptor;
​
// Log the change of the NFT descriptor.
emit ISablierFlowBase.SetNFTDescriptor({
admin: msg.sender,
oldNFTDescriptor: oldNftDescriptor,
newNFTDescriptor: newNFTDescriptor
});
​
// @audit => _toTokenId may be zero
// Refresh the NFT metadata for all streams.
emit BatchMetadataUpdate({ _fromTokenId: 1, _toTokenId: nextStreamId - 1 });
}
function setProtocolFee(IERC20 token, UD60x18 newProtocolFee) external override onlyAdmin {
// Check: the new protocol fee is not greater than the maximum allowed.
if (newProtocolFee > MAX_FEE) {
revert Errors.SablierFlowBase_ProtocolFeeTooHigh(newProtocolFee, MAX_FEE);
}
​
UD60x18 oldProtocolFee = protocolFee[token];
​
// Effects: set the new protocol fee.
protocolFee[token] = newProtocolFee;
​
// Log the change of the protocol fee.
emit ISablierFlowBase.SetProtocolFee({
admin: msg.sender,
token: token,
oldProtocolFee: oldProtocolFee,
newProtocolFee: newProtocolFee
});
​
// @audit => _toTokenId may be zero
// Refresh the NFT metadata for all streams.
emit BatchMetadataUpdate({ _fromTokenId: 1, _toTokenId: nextStreamId - 1 });
}

Impact

Impact as analyzed above.

Tools Used

Human Analysis

Recommendations

The code needs to be modified:

if (nextStreamId == 1) {
emit BatchMetadataUpdate({ _fromTokenId: 1, _toTokenId: nextStreamId});
return;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.