Flow

Summary

Withdraw functions allow anyone to withdraw from a stream which can be used to grief other users' streams through fees

Vulnerability Details

Withdraw functions allow anyone to withdraw from a stream as long as the to is either the sender, the recipient or an approved user. This however doesn't account for fact that the stream is still active and not voided, and that protocol fees are charged upon withdrawal which can be used to grief the streams.

By looking at the withdraw and withdrawMax functions, we can see that anyone can withdraw from the streams as long as the to is the sender, an approved user or the owner of the stream.

However, we can also see that a stream doesn't have to be void or paused before it can be withdrawn from. A stream could actively be streaming, an anyone can temporarily block streaming by just withdrawing the tokens to the approved to. Also, when protocol fee is being charged on withdrawal, the amount received by the to will be significantly lesser due to the fees being charged. This can lead to some sort of indirect griefing of the stream's participant.

Consider the following case

1. Sender creates a stream of 100 tokens and is about to start streaming.

2. Malicious user withdraws the tokens the stream

3. Protocol fee of 5 is deducted and the to is left with 95 tokens.

4. Since the stream is not voided, tokens can still be deposited to ensure that streaming can continue.

5. Malicious user withdraws again and the protocol charges some more fees.

To prevent this from happening the stream participants have to either void the stream making it unusable or risk malicious interference in their streaming activity.

Impact

Malicious users can withdraw from active streams temporairily pausing streams while griefing stream participants through protocol fees.

Tools Used

Manual review

Recommendations

Allow only specified users to withdraw from a stream, or only allow withdrawals on voided streams.