Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing `notVoided()` modifier on `depositAndPause()`

greed

Summary

The notVoided() modifier is used to make sure the stream the user is trying to deposit into is not voided.

All the deposit*() functions implement this modifier.

https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L264

function deposit(
uint256 streamId,
uint128 amount,
address sender,
address recipient
)
external
override
noDelegateCall
notNull(streamId)
@> notVoided(streamId)
updateMetadata(streamId)

Vulnerability Details

The issue is that this safeguard is not implemented on depositAndPause()

Impact

Tokens can be deposited on a voided stream.

Tools Used

Manual review

Recommendations

Add the notVoided() modifier on the depositAndPause() function

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.