Flow

Summary

in the function SablierFlow::depletionTimeOf, the MVT represents Minimum Value Transferable, the smallest amount of token that can be transferred and must be always 1 in token's decimal, and which the fixed decimal for tokens is 18.

If the token is actually upgradable or have proxies, and decimals set to below or above 1, there will break in functonality.

Vulnerability Details

Impact

Once the token's decimal is below 1, there will be underflow on the minimum transfer value it should be.

At the same time, token's decimal above 1. there will be overflow in the minimum transfer value causing user to send more than required, breaking the functionality of the protocol.

Tools Used

Manual Review

Recommendations

There must be a check to ensure the tokens decimal is always 18, since that is the fixed decimal according to the docs