Submission Details
Severity:
Missing `_verifyStreamSenderRecipient()` in `depositAndPause()`
Summary
The _verifyStreamSenderRecipient() function is used to verify the stream the user tries to interact with is actually the intended one by comparing the stream's recipient and sender to parameters supplied by the user.
This check has been implemented in all deposit*() functions.
https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L268
function deposit(
uint256 streamId,
uint128 amount,
address sender,
address recipient
)
external
override
noDelegateCall
notNull(streamId)
notVoided(streamId)
updateMetadata(streamId)
{
// Check: the provided sender and recipient match the stream's sender and recipient.
@> _verifyStreamSenderRecipient(streamId, sender, recipient);
Vulnerability Details
The issue is that this safeguard is missing in the depositAndPause() function
Impact
Tokens may be deposited in an unintended stream.
Tools Used
Manual review
Recommendations
Add the _verifyStreamSenderRecipient() check in the depositAndPause() function.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.