Missing UpdateMetadata Emit
Summary
In SablierFlow contract the function createAndDeposit the MetadataUpdate event is not emitted. The function mints and deposits a token(stream).
Vulnerability Details
While in the EIP it is said that "not emitting MetadataUpdate event is RECOMMENDED when a token is minted", the function createAndDeposit also deposits into the given stream. If we look at the deposit function we can see that it emits an MetadataUpdate event. This creates a discrepancy in which on-chain and off-chain programs relying on the given event will not receive the correct information.
Impact
On-chain and off-chain programs relying on the given event will not receive the correct information.
Tools Used
Manual Review
Recommendations
Emit the MetadataUpdate event after the createAndDeposit functions finishes its job.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.