Flow

Summary

The SablierFlow contract uses ongoing debt calculations to manage token streaming payments. The ongoing debt is computed based on the elapsed time from snapshotTime to the current block.timestamp, multiplied by ratePerSecond. If the debt reset logic does not properly update snapshotTime or fails to recalculate debt accurately, it can lead to the underestimation of ongoing debt. This vulnerability can result in financial inconsistencies, negatively impacting both the recipients and the contract’s overall stability.

Vulnerability Details

1. Description: The vulnerability occurs when the debt reset mechanism fails to update snapshotTime correctly or does not fully recalculate the accrued debt. This can happen in scenarios where the debt is adjusted, but past obligations are not accounted for, or when the timestamp management is flawed. The result is an underestimation of the ongoing debt owed to stream recipients.

2. Mechanisms:

   • Debt Reset Without Timestamp Update: If the snapshotTime is not updated to block.timestamp after resetting or adjusting the debt, the elapsed time used in debt calculations becomes artificially shorter, leading to underestimated debt.

   • Improper Debt Recalculation: Failing to incorporate past debt when adjustments are made can cause a discrepancy between the actual and expected debt amounts.

   • Pause and Resume Logic: Inaccuracies can also arise if the contract does not properly handle timestamp adjustments when streams are paused and then resumed.

Impact

1. Financial Loss for Recipients: Underestimation of debt results in recipients receiving fewer tokens than they are entitled to. This could cause trust issues, dissatisfaction, and potential disputes.

2. Accumulated Contract Liability: The contract may unknowingly accrue hidden liabilities that become problematic if a large payout is suddenly required. This could destabilize the contract's financial health.

3. Operational and Reputational Risks: Inaccurate debt calculations undermine the reliability of the service. If the vulnerability is publicly exposed, it could damage the project’s reputation and erode user confidence.

4. Potential Exploitation: Although less direct than other vulnerabilities, the issue could be exploited by savvy users who may try to withdraw funds strategically based on the incorrect debt calculations.

Tools Used

Tests

Recommendations

Always update snapshotTime to block.timestamp when debt is reset or when parameters that affect debt accumulation are modified. This ensures that the elapsed time used in calculations is accurate.