Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing `notVoided()` modifier on `depositAndPause()`

greed

Summary

The notVoided() modifier is used to make sure the stream the user is trying to deposit into is not voided.

All the deposit*() functions implement this modifier.

https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L264

function deposit(
uint256 streamId,
uint128 amount,
address sender,
address recipient
)
external
override
noDelegateCall
notNull(streamId)
@> notVoided(streamId)
updateMetadata(streamId)

Vulnerability Details

The issue is that this safeguard is not implemented on depositAndPause()

Impact

Tokens can be deposited on a voided stream.

Tools Used

Manual review

Recommendations

Add the notVoided() modifier on the depositAndPause() function

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago
inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.