Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Setting the `sender` to a zero address should be allowed

tnevler24

Summary

The creator of a stream may deliberately want to set the sender address to a zero address.

Vulnerability Details

By setting the sender address to a zero address, the stream creator can assure potential depositors that funds cannot be stolen. The point is not that someone can break a promise. Although it is assumed that all parties trust each other, the creator of the stream may intentionally want to give a 100% guarantee of their trustworthiness and consciously refuse to use refunding, changing rps, pausing, and voiding.

Impact

The use of the described functionality is relatively likely (especially in use cases with multiple depositors), however, it is currently not allowed.

PoC

function _create(
address sender,
address recipient,
UD21x18 ratePerSecond,
IERC20 token,
bool transferable
)
internal
returns (uint256 streamId)
{
// Check: the sender is not the zero address.
if (sender == address(0)) {
@> revert Errors.SablierFlow_SenderZeroAddress();
}
//...
}

Tools Used

Manual review.

Recommendations

Allow setting sender to a zero address.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.