Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

uint96 Token Compatibility Issues

ro1sharkm

Summary

The current implementation fails to account for tokens that revert on transfers larger than uint96 (e.g., UNI, COMP). This can lead to locked funds.

Vulnerability Details

collectProtocolRevenue() function:

uint128 revenue = protocolRevenue[token];
// ...
token.safeTransfer({ to: to, value: revenue });

protocolRevenue is stored as uint128.
If accumulated revenue exceeds uint96.max (79,228,162,514,264,337,593,543,950,335)
,transfer will revert for UNI/COMP tokens
.

Funds become permanently locked in the contract

recover() function:

uint256 surplus = token.balanceOf(address(this)) - aggregateBalance[token];
token.safeTransfer(to, surplus);

surplus is calculated as uint256

No check for uint96 limit before transfer

Large surplus recoveries will fail for UNI/COMP tokens

Can lead to permanent fund lockup

Impact

When the revenue or surplus exceeds the uint96 limit, the safeTransfer function reverts. This bug can prevent the protocol from collecting revenue or recovering surplus tokens when dealing with tokens like UNI or COMP.

Tools Used

Manual review

Recommendations

document the special handling of tokens with uint96 storage limits

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.