Flow

Summary

Streams could be used for various purpose which inclue raiaing funds for payment/business/project/crowdfunding. If used for crowdfunding, stream creator could use a very negligible amount as ratePerSecond to make total debt negligible as well(no matter the duration).

Vulnerability Details

Instance

1. Alice creates a stream to crowfund a project, so multiple parties can deposit to the stream.

2. After a year of deposit, 1,000,000 USDC was accumulated by the stream

3. 31,536,000 seconds(1 year) have passed, if only 1wei was used as the ratePerSecond, less than 1_USDC of debt would have been generated.

4. Sender then calls refund which fails to charge protocl fee before sending back the entire raised amount to the sender.

Impact

Protol would lose fees, if most streamers operates in this manner.

Tools Used

Manual review.

Recommendations

Deduct fees from refund.