Flow

Summary

SablierFlow implements the IERC4906 interface and various tenets of the EIP-4906 standard but not the supportsInterface, which causes that the flow streams cannot be identified as EIP-4906 compliant by external integrations.

Vulnerability Details

First, we see that the flow contract is ISablierFlow and implements EIP-4906 MetadataUpdate extension for ERC721 tokens.

From EIP-4906's motivation,

Many EIP-721 contracts emit an event when one of its tokens’ metadata are changed. While tracking changes based on these different events is possible, it is an extra effort for third-party platforms, such as an NFT marketplace, to build individualized solutions for each NFT collection.

Having a standard MetadataUpdate event will make it easy for third-party platforms to timely update the metadata of many NFTs

The codebase for the most part strictly adheres to the standard by constantly emitting the ERC-4906 event to trigger an update of the NFT metadata through the updateMetadata modifier. We can see that virtually of the the function that affects the flow emits this event, indicating a strict compliance to the standard.

However, the contract is still missing the supportsInterface function, making it not fully compliant.

According to the standard, the supports interface MUST return true when called with 0x49064906.

The MetadataUpdate or BatchMetadataUpdate event MUST be emitted when the JSON metadata of a token, or a consecutive range of tokens, is changed.

...

The supportsInterface method MUST return true when called with 0x49064906.

But from the test below which can be addded to any of the integration test files, we can see that it doesn't. It only returns true for ERC721 and ERC165 interface Ids.

Impact

Lack of full compliance with the standard. Also, since the flow will be used in tandem with other external contracts and integrations for actions like rewards distributions, external integrations that rely on qeurying its supportsInterface to verify its ERC4906 compliance will not be able properly do so due to its non-existence in the contract.

Tools Used

Manual review

Recommendations

Introduce the supportsInterface function.