Submission Details
Severity:
adversarial minting of NFT to clog wallet of valid recipient
Summary
A legitimate recipient can have their wallet filled with NFTs that were created with 0 deposits.
Vulnerability Details
Any user can call createto mint Sablier NFTs for only gas fees to the wallet of a recipient, making NFTs impossible to manage.
function _create(
address sender,
address recipient,
UD21x18 ratePerSecond,
IERC20 token,
bool transferable
)
Impact
Management of Sablier NFTs will be difficult, if a user mints streamId of 101 and gets NFTs from 101 - 200.
Tools Used
Manual Review
Recommendations
Permissioned create to reduce the amount of Sablier NFTs minted for free.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.