Flow

Vulnerability Details

From the Technical Docs, we can see the refundable amount (ra) is the amount that can be refunded to the sender. It is defined as the difference between the stream balance and the total debt.

But the code in the SablierFlow::_refundableAmountOfreturns the _streams[streamId].balance - _coveredDebtOf(streamId);which is incorrect as covered debt is different from the total debt.

Impact

The _refundableAmountOfamount calculation will be incorrect as the total debt is defined as the total amount the sender owes to the recipient. It is calculated as the sum of the snapshot debt and the ongoing debt whereas covered debt is The covered debt (cd) is defined as the minimum of the total debt and the stream balance.

Tools Used

Manual Review

Recommendations

We recommend subtracting the _totalDebtOfinstead of _coveredDebtOf