Flow

Summary

The depletionTimeOf function uses an unchecked block for gas optimization when performing critical time calculations, assuming these operations cannot overflow. This assumption becomes dangerous when dealing with extreme but valid stream parameters - high token balances, small rates, or extended timeframes. The core calculation solvencyAmount = balanceScaled - snapshotDebtScaled + oneMVTScaled and subsequent time computations lack bounds validation inside the unchecked block, potentially leading to silent overflows that corrupt stream timing data.

The integer overflow risk in depletionTimeOf centers around the unchecked block containing critical calculations:

https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L57

While the comment states these calculations "cannot overflow", this assumption might not hold for extreme cases:

1. Large balanceScaled values from high-decimals tokens

2. Long-running streams with high snapshotTime

3. Very small ratePerSecond leading to large solvencyPeriod

The unchecked block skips overflow checks for gas optimization, but lacks proper bounds validation for these extreme cases.

Impact

The unchecked arithmetic operations in depletionTimeOf create a latent vulnerability that manifests with extreme but valid stream parameters. When handling large token balances combined with small rates or extended timeframes, the function's core calculations can silently overflow, producing incorrect depletion timestamps that appear valid but are mathematically impossible. This corruption of stream timing data propagates through any DeFi protocols or automation systems relying on accurate depletion forecasts, potentially triggering premature liquidations or allowing streams to continue beyond their true depletion points. The issue becomes particularly dangerous because the overflow occurs silently within an unchecked block, making it difficult for integrating systems to detect or protect against such mathematical anomalies.

Fix

This fix addresses integer overflow risks by replacing unchecked arithmetic with explicit bounds validation