Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Wrong natspec in 'ISablierFlow::pause' can mislead users or developers

securechain

Description: The natspec for 'ISablierFlow::pause' incorrectly states that it does not set the snapshot time to the current block timestamp. However, it does set the snapshot time to the current block.timestamp because 'pause' calls 'SablierFlow::_adjustRatePerSecond', which sets the snapshot time to the current block.timestamp.

Impact: The natspec is incorrect and can mislead developers integrating the protocol and not account for the block.timestamp being updated. Users may also be misled if they rely on the documentation.

Proof of Concept:

  1. 'SablierFlow::_pause' calls 'SablierFlow::_adjustRatePerSecond'

  2. 'SablierFlow::_adjustRatePerSecond' sets the snapshot time to the current block.timestamp

SablierFlow.sol line 557

function _adjustRatePerSecond(uint256 streamId, UD21x18 newRatePerSecond) internal {
// Check: the new rate per second is different from the current rate per second.
if (newRatePerSecond.unwrap() == _streams[streamId].ratePerSecond.unwrap()) {
revert Errors.SablierFlow_RatePerSecondNotDifferent(streamId, newRatePerSecond);
}
​
uint256 ongoingDebtScaled = _ongoingDebtScaledOf(streamId);
​
// Update the snapshot debt only if the stream has ongoing debt.
if (ongoingDebtScaled > 0) {
// Effect: update the snapshot debt.
_streams[streamId].snapshotDebtScaled += ongoingDebtScaled;
}
​
// Effect: update the snapshot time.
@> _streams[streamId].snapshotTime = uint40(block.timestamp);
​
// Effect: set the new rate per second.
_streams[streamId].ratePerSecond = newRatePerSecond;
}

Recommended Mitigation:

  • Remove the natspec comment for 'ISablierFlow::pause' since it is incorrect.

/// @notice Pauses the stream.
///
/// @dev Emits {PauseFlowStream} event.
///
/// Notes:
- /// - It does not set the snapshot time to the current block timestamp.
/// - It updates the snapshot debt by adding up ongoing debt.
/// - It sets the rate per second to zero.
///
/// Requirements:
/// - Must not be delegate called.
/// - `streamId` must not reference a null or an already paused stream.
/// - `msg.sender` must be the stream's sender.
///
/// @param streamId The ID of the stream to pause.
function pause(uint256 streamId) external;
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.