Flow

Summary

The _coveredDebtOf function in SablierFlow.sol has a logical flaw in its conditional check that can prevent the intended recipient from withdrawing the full stream balance when the balance equals the total debt. This issue results in the withdrawMax function not processing the withdrawal correctly under specific conditions, potentially leaving funds locked.

Vulnerability Details

In SablieFlow:coveredDebtOf() , the if statement only checks when the balance is less than the total debt. This means that when the balance is equal to the total debt, it returns the total debt instead of the stream balance, hence making the withdrawal not happen as the function coveredDebtOf() is called in the withdrawMax()function by the intended recipient.

https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L467-L470
https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L435C3-L450C6

Impact

When the balance is equal to totalDebt, the withdrawMax function fails to process the intended withdrawal for the recipient. This could prevent users from retrieving their funds as expected.

scenario:

1. a stream created where the stream balance equals the total debt (e.g., both set to 1000 tokens).

2. withdrawMax is called for this stream.

3. Observe that the function fails to allow full balance withdrawal.

   the function should allow withdrawal if the balance is equal to the total debt but does not do so due to the logical flaw.

Tools Used

manual review

Recommendations

In the coveredDebtOf function, update the condition to include an equality check.This change will ensure that withdrawMax behaves as expected, allowing the full balance to be withdrawn when the balance equals the total debt.