Flow

Summary

The SablierFlow contract lacks validation for input addresses, allowing zero addresses to be used as inputs, which can lead to loss of funds and potential contract exploitation.

Finding Description

In the current implementation of the SablierFlow contract, there are instances where addresses are not validated before being used in critical functions. The absence of checks for zero addresses can break the expected security guarantees of the contract. Specifically, if a user tries to create a flow or perform a withdrawal operation using a zero address, it may lead to unintended consequences, such as the inability to recover funds sent to that address.

For instance, if a malicious user or a user unknowingly passes a zero address to the _withdraw function, the contract will attempt to transfer funds to that address. Since the zero address is not a valid recipient, the transaction will fail, but any funds intended for that address could be rendered unrecoverable. This vulnerability may propagate through the system if the malicious input is not caught early, leading to significant financial implications.

Vulnerability Details

• Type: Input Validation

• Location: SablierFlow.sol

• Functionality Affected: Critical functions that handle transfers, including flow creation and withdrawal.

• Security Guarantee Broken: Proper handling and validation of user inputs to prevent the use of invalid addresses.

Impact

This vulnerability can lead to a High Impact scenario where users may inadvertently or maliciously lose funds. The inability to recover funds sent to a zero address can result in a loss of trust in the contract, damaging its reputation and usability. The financial consequences can be severe, especially if a significant amount of funds are involved.

Proof of Concept

In the above example, the _withdraw function should include a check to ensure that _to is not a zero address.

Recommendations

To address this vulnerability, input validation checks should be implemented wherever user inputs are received. Specifically, the contract should enforce that addresses passed to critical functions must not be zero addresses. Here's a code snippet demonstrating the fix: