Flow

Summary

Protocol plans to support all possible ERC20 tokens, except for some criteria but will not be able to support tokens that do not impelement the decimals function.

Vulnerability Details

The protocol plans to work with any ERC20 token based on the information provided in the readme. Expect for those with the criteria highlighted below.

Any ERC-20 token can be used with Flow as long as it adheres to the following assumptions:

1. The total supply of any ERC-20 token remains below , i.e., type(uint128).max.

2. The transfer and transferFrom methods of any ERC-20 token strictly reduce the sender's balance by the transfer amount and increase the recipient's balance by the same amount. In other words, tokens that charge fees on transfers are not supported.

3. An address' ERC-20 balance can only change as a result of a transfer call by the sender or a transferFrom call by an approved address. This excludes rebase tokens, interest-bearing tokens, and permissioned tokens where the admin can arbitrarily change balances.

4. The token contract does not allow callbacks (e.g., ERC-777 is not supported).

However, the SablierFlow incorrectly assumes that the token to be streamed by the creator implements a decimal function. This is because, upon stream creation, an attempt is made to get the token's decimals by calling the decimals function.

However, not all tokens (including the standard ones) actually implement a decimals function. According to EIP-20 standard,

decimals

Returns the number of decimals the token uses - e.g. 8, means to divide the token amount by 100000000 to get its user representation.

OPTIONAL - This method can be used to improve usability, but interfaces and other contracts MUST NOT expect these values to be present.

But by querying the decimal function, due to its non-existence in these tokens, the functions will fail causing that streams for these tokens cannot be created.

Impact

Flow streams for tokens like cloutContracts,
DigixDAO, etc cannot be created if desired due to the absence of the decimal function breaking compatibility.

Tools Used

Manual review.

Recommendations

Recommend using a tryCatch block to query the decimals. If it fails, hardcode it to 18 for scaling.