Flow

Summary

in SablierFlowBase::collectProtocolRevenue, there is no assert to maintain the aggregateBalance[token]. With aggregateBalance[token] in an incorrect state, calculations and checks that rely on its accuracy may fail, leading to unexpected behavior in other parts of the contract.

Vulnerability Details

Impact

Functions that interact with the balance might assume there are sufficient funds when there aren’t, potentially destabilizing the protocol. Attackers could exploit this misrepresented balance to withdraw funds beyond the actual available balance, resulting in financial losses for the protocol.

Tools Used

Manual Review

Recommendations

Assert that the aggregate balance does not fall below protocol revenue.