user could withdraw all funds
Summary
Vulnerability Details
https://github.com/Cyfrin/2024-10-sablier/blob/main/tests/invariant/handlers/FlowHandler.sol#L257
the withdraw function is used to implement the withdrawal logic it make sure the withdraw amount is non zero and its less or equal to the withdrawable amount but this function lacks an important logic to restrict a particular recipient from withdrawing all the withdrawable amount
this function do not check the amount a recipient can withdraw
Impact
a particual recipient can withdraw all the fund in the stream as long as the amount he specify is not more than the max withdrawable amount
Tools Used
manual
Recommendations
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.