Flow

Summary

It can be observed that the stream can be void at any time and also the sender, receiver and approved third party can void the stream.

To void a stream we only take streamId as arguments and processed with the void process.

Vulnerability Details

To void stream the sender , receiver or operator are allowed to call the void function.

As it is evident from the above code that Sender , Receiver and third party are allowed to void the stream. In this case the following scenario could occur and result in void of wrong stream.

1. User A creates a stream with User B, designating User C as the approved third party.StreamId = 1.

2. Within the same block, another user initiates a stream with User D, also designating User C as the approved third party. StreamId = 2.

3. A block re-org occurs, causing a reordering of transactions.As a result, StreamId = 2 is now associated with User B, and StreamId = 1 is now associated with User D.

4. User C, the approved third party, decides to void the stream with User B, assuming StreamId = 1 still corresponds to User B.

5. Due to the re-org, voiding StreamId = 1 now affects User D instead of User B.

Impact

The operator or third party will void the incorrect stream, which cannot be restarted once voided. This will require the creation of a new stream, disrupting the existing stream’s continuity.

Tools Used

Manual Review

Recommendations

Use the internal function _verifyStreamSenderRecipient inside void.