Submission Details
Severity:
`recover()` allows sweeping all `streams`' aggregated balances for streaming tokens with multiple addresses
## Summary
If a `stream` is created with a multi-address token, an admin can accidentally sweep the total amount locked in the `stream` via the [`SablierFlowBase::recover()`](https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/abstracts/SablierFlowBase.sol#L230).
## Vulnerability Details
Some ERC-20 tokens have multiple addresses (e.g., sUSD, sBTC, SNX, etc.), and the computation for the [surplus amount](https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/abstracts/SablierFlowBase.sol#L231) in the `recover()` below cannot prevent the streaming tokens in question from being drained out mistakenly.
```solidity
function recover(IERC20 token, address to) external override onlyAdmin {
//@audit -- This computation cannot prevent multi-address tokens from being drained out mistakenly.
@> uint256 surplus = token.balanceOf(address(this)) - aggregateBalance[token];
// Check: there is a surplus to recover.
if (surplus == 0) {
revert Errors.SablierFlowBase_SurplusZero(address(token));
}
// Interaction: transfer the surplus to the provided address.
token.safeTransfer(to, surplus);
emit Recover(msg.sender, token, to, surplus);
}
```
- https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/abstracts/SablierFlowBase.sol#L231
## Impact
This vulnerability can affect all `streams` created with a multi-address token (as a streaming token). In other words, an admin can accidentally sweep all aggregated balances (across the `streams`).
## Tools Used
Manual Review
## Recommendations
Implement a whitelist and allow only permitted ERC-20 tokens to be used as streaming tokens.
Updates
Lead Judging Commences
inallhonesty 8 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Tokens with two addresses
Appeal created
serialcoder
8 months ago
inallhonesty
8 months ago
inallhonesty 8 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Tokens with two addresses
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.