Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Insufficient Validation of Recipient and Sender in Stream Functions Can Lead to Unauthorized Access

0xgee001

Summary

The deposit, withdraw, and adjustRatePerSecond functions rely on the onlySender modifier and _verifyStreamSenderRecipient to verify caller identity. However, insufficient validation could allow attackers to impersonate either party, resulting in unauthorized actions.

Vulnerability Details

These functions depend on onlySender and _verifyStreamSenderRecipient for validation, without additional checks to securely verify the sender and recipient roles:

function deposit(...) external onlySender(streamId) {
// Assumes onlySender ensures caller is the legitimate stream sender
}

This lack of comprehensive validation could enable attackers to impersonate the sender or recipient, potentially adjusting the rate, depositing, or withdrawing funds fraudulently.

Impact

Unauthorized access could allow:

  1. Manipulation of stream parameters, such as rate adjustments.

  2. Unauthorized withdrawals, resulting in financial loss for legitimate users.

Tools Used

Manual code review

Recommendations

Strengthen sender and recipient validation by incorporating off-chain hashing and signing to verify identities securely.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.