Flow

Summary

The withdrawableAmountOf function in the SablierFlow contract does not account for protocol fees when calculating the withdrawableAmount for a specific stream. As a result, users are shown an inflated withdrawableAmount that includes fees, potentially leading to over-withdrawal and impacting protocol revenue.

Vulnerability Details

The withdrawableAmountOf function calculates the amount available for withdrawal based on the stream's covered debt using the _coveredDebtOf function. However, it fails to deduct the protocol fee specified for the associated token in the protocolFee mapping.

Due to this missing fee deduction, the protocol shows users an inaccurate withdrawable amount that does not account for fees. This may lead users to believe they can withdraw the total amount. This oversight could result in funds being withdrawn without the appropriate fee, affecting both protocol revenue and the stability of the balance calculations.

Impact

1. Revenue Loss: The protocol fee set by the protocol is not deducted from the withdrawable amount, leading to potential revenue loss for the protocol. Over time, this could result in significant financial losses.

2. User Confusion: Users may assume that they can withdraw the full amount displayed, resulting in confusion if the protocol later requires fee adjustments or additional transactions to cover uncollected fees.

3. Protocol Stability: Failure to deduct fees can affect the integrity of balance and debt calculations, potentially impacting other contract functions that depend on accurate fund tracking.

Tools Used

Manual Review

Recommendations

Modify the withdrawableAmountOf function to incorporate the protocol fee deduction by using the calculateAmountsFromFee helper function. This can be done by first calculating the gross withdrawableAmount Then, the protocol fee is applied, returning only the net amount as shown below