Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

MEV attacks Exploit Potential due to missing deadline function.

jerrytomi

Summary

MEV bots exploits or attacker is possible since deadline is absent in the SablierFlow:withdrawfunction and have higher chance when transaction is in the mempool.

Vulnerability Details

Here is the details:

function withdraw(
uint256 streamId,
address to,
uint128 amount
)
external
override
noDelegateCall
notNull(streamId)
updateMetadata(streamId)
returns (uint128 withdrawnAmount, uint128 protocolFeeAmount)
{
// Checks, Effects, and Interactions: make the withdrawal.
(withdrawnAmount, protocolFeeAmount) = _withdraw(streamId, to, amount);
}

Impact

MEV (Miner Extractable Value) attacks may occur if a pending transaction in the mempool remains open-ended, allowing malicious entities to profit off delayed transactions.

Tools Used

Manual Review

Reccommendation

deadlineparameter is recommended to be used in the withdrawfunction below to prevent MEV attacks on pending transactions.

function withdraw(
uint256 streamId,
address to,
uint128 amount,
+ uint256 deadline,
)
external
override
noDelegateCall
notNull(streamId)
updateMetadata(streamId)
returns (uint128 withdrawnAmount, uint128 protocolFeeAmount)
{
// Checks, Effects, and Interactions: make the withdrawal.
(withdrawnAmount, protocolFeeAmount) = _withdraw(streamId, to, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.