Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Streams cannot be created if ERC20 token is USDT in Ethereum

x1485967

Summary

Some ERC20 tokens are not compliant with IERC20Metadata().decimals(), for example, USDT in Ethereum. This will cause create() function reverted if token is USDT in Ethereum.

Vulnerability Details

In SablierFlow, users can create one stream via create() function. In create function, we will record payment token's decimal. We get the payment token's decimal via IERC20Metadata(address(token)).decimals(). The problem is that some tokens are not complicant with the stander IERC20Metadata().decimals() interface, for example, USDT token in Ethereum.

This will cause the IERC20Metadata(address(token)).decimals()reverted. Users cannot create one stream based on the USDT Token.

function _create(
address sender,
address recipient,
UD21x18 ratePerSecond, // 21 + 18 = 39. Uint256.max = 78 digits.
IERC20 token,
bool transferable
)
internal
returns (uint256 streamId)
{
// Check: the sender is not the zero address.
if (sender == address(0)) {
revert Errors.SablierFlow_SenderZeroAddress();
}
// @audit here the interface IERC20Metadata's decimals need to return uint8, but in Ethereum USDT token, decimal's return type is uint,
// This will cause revert. Because USDT is not complicant with this interface.
uint8 tokenDecimals = IERC20Metadata(address(token)).decimals();
​

Impact

Users cannot create streams using USDT in Ethereum.

Tools Used

Manual

Recommendations

Suggest to use low-level call to check the decimal to support USDT in Ethereum.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Tokens without the decimals() implementation

Appeal created

x1485967 Submitter
8 months ago
inallhonesty Lead Judge
8 months ago
inallhonesty Lead Judge
8 months ago
inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Tokens without the decimals() implementation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.