Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No way to refund max

0xtheblackpanther

Summary

The Sablier Flow protocol lacks a refundMax function, unlike its withdrawal counterpart withdrawMax. This asymmetry creates potential issues with transaction failures and front-running opportunities.

Vulnerability details

The current refund mechanism requires users to:

  1. Query refundable amount

  2. Submit separate refund transaction

function _refund(uint256 streamId, uint128 amount) internal {
uint128 refundableAmount = _refundableAmountOf(streamId);
if (amount > refundableAmount) {
revert Errors.SablierFlow_RefundOverflow(
streamId,
amount,
refundableAmount
);
}
// ... rest of refund logic
}

What's the impact?

  • Failed transactions due to amount changes between query and execution

  • Wasted gas from transaction retries

  • Poor UX for senders trying to refund maximum amount

  • Increased likelihood of front-running attacks

What's the likelihood?

LOW - This scenario is likely to occur in active streams where:

  • Recipients frequently withdraw

  • Senders need to refund maximum amounts

  • MEV bots monitor for refund opportunities

Proof of concept

Let's do a pseudo PoC

// Attack Scenario
contract RefundAttack {
function attack() external {
// 1. Monitor for refund transactions
uint128 refundable = flow.refundableAmountOf(streamId);
// 2. Front-run with withdraw
flow.withdraw(streamId, recipient, amount);
// 3. Original refund transaction fails
// flow.refund(streamId, refundable); // Reverts
}
}

Recommendation

Implement refundMax function similar to withdrawMax:

function refundMax(uint256 streamId) external
notNull(streamId)
onlySender(streamId)
returns (uint128)
{
uint128 refundable = _refundableAmountOf(streamId);
_refund(streamId, refundable);
return refundable;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.