Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

One can still deposit by passing the wrong recipient

bauchibred

Vulnerability Details

Flow uses the _verifyStreamSenderRecipient helper function to beofre deposits to ensure the stream sender and
recipient matches, this can be seen in the SablierFlow contract and the methods used in deposition, issue however is
that when calling the depositAndPause() functionality this is never used see
https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/SablierFlow.sol#L274-L293,
and only the sender is checked for.

​
function depositAndPause(
uint256 streamId,
uint128 amount
)
external
override
noDelegateCall
notNull(streamId)
notPaused(streamId)
onlySender(streamId)
updateMetadata(streamId)
{
// Checks, Effects, and Interactions: deposit on stream.
_deposit(streamId, amount);
​
// Checks, Effects, and Interactions: pause the stream.
_pause(streamId);
}
​

Impact

Users can break accounting by depositing and passing the wrong stream recipient.

Tools Used

Manual review

Recommendations

Apply a change that takes into consideration the fact that the recipient could be wrong.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago
inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.