Flow

Relevant GitHub Links

https://github.com/sablier-labs/flow/blob/5b3e293c24f9bf50e73876d67b0981779e865300/src/abstracts/SablierFlowBase.sol#L220

Summary

Underflow can occur and corrupt the aggregateBalance[token] or always revert the transaction in the SablierFlowBase::collectProtocolRevenue function.

Vulnerability Details

In the SablierFlowBase::collectProtocolRevenue function, we’re using unchecked to decrement aggregateBalance[token] -= revenue, which can lead to underflow if aggregateBalance[token] is less than revenue. This would wrap the balance, leading to an incorrect (often very large) balance, potentially impacting other functions relying on aggregateBalance.

Impact

• Potentially Incorrect Balance Tracking : Without Underflow Protection, if the underflow wraps aggregateBalance[token] to a large number, it could indicate that the contract has a high balance of tokens, which is incorrect.

• Revenue Collection Disruptions or DOS : collectProtocolRevenue is expected to reset the protocolRevenue to zero after collection, but the underflow and revert can prevent the revenue from being collected. This means the revenue will remain in protocolRevenue, preventing access to these funds until the issue is resolved.

Tools Used

Manual review.

Recommendations