Flow

Summary

https://github.com/Cyfrin/2024-10-sablier/blob/main/src/abstracts/SablierFlowBase.sol

The collectProtocolRevenue and recover functions are susceptible to reentrancy attacks. Although they use SafeERC20 for transfers, which addresses some reentrancy risks, it’s still possible for a malicious contract to re-enter the function before state changes are fully finalized. Specifically, if the aggregateBalance or protocolRevenue values are manipulated before they’re reset, it could result in additional unauthorized transfers.

Impact

Successful exploitation could allow an attacker to drain the contract's revenue or surplus funds, leading to loss of assets held by the contract.

Tools Used

Manual Review

Recommendations

Add a nonReentrant modifier to the collectProtocolRevenue and recover functions to prevent reentrancy. This modifier will ensure that these functions cannot be called again until they finish execution.