Submission Details
Severity:
Potential Reentrancy Attack in Revenue Collection
location: /src/abstracts/SablierFlowBase.sol
Description: The collectProtocolRevenue function transfers tokens after changing the state of the contract. This pattern is vulnerable to reentrancy attacks, especially if the safeTransfer function is called and the recipient is a malicious contract.
Code Reference:
protocolRevenue[token] = 0; // State change before transfer
token.safeTransfer(to, surplus); // External call
Impact:
A malicious contract could call
collectProtocolRevenuerecursively, leading to unexpected behavior and financial loss.
-
Recommendations:
Use a checks-effects-interactions pattern by first transferring the tokens and then updating the state variable. Alternatively, utilize reentrancy guards:
modifier nonReentrant() {
require(!reentrantStatus, "Reentrant call");
reentrantStatus = true;
_;
reentrantStatus = false;
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.