Flow

Summary :

Vulnerability Details : The _withdraw function in the SablierFlow contract is designed to withdraw a specified amount of tokens from a stream. The function takes three parameters:

• streamId: The ID of the stream from which to withdraw tokens.

• to: The address to which the tokens should be transferred.

• amount: The amount of tokens to withdraw.

The function uses a strict equality comparison (==) to check if the amount variable is equal to 0:

This comparison is used to prevent withdrawals of 0 tokens, which would be unnecessary and potentially wasteful.

Problem:

However, the use of a strict equality comparison (==) can be problematic. In Solidity, the == operator checks for exact equality between two values. This means that if the amount variable is very close to 0, but not exactly equal, the comparison will return false.

For example, suppose the amount variable is calculated to be 0.000001 due to a precision issue. In this case, the strict equality comparison (==) will return false, even though the value is essentially 0.

Impact : This can lead to incorrect behavior in the contract, including:

• Incorrect withdrawal amounts: The contract may allow withdrawals of amounts that are very close to 0 but not exactly equal.

• Reverts: The contract may revert when attempting to withdraw an amount that is very close to 0 but not exactly equal.

Example:

Suppose the amount variable is calculated to be 0.000001 due to a precision issue. In this case, the strict equality comparison (==) will return false, even though the value is essentially 0.

Proof of Concept Code : Here is a proof of concept code that demonstrates the vulnerability..

This code creates a new contract called ExploitContract that has a reference to the SablierFlow contract. The exploit function sets the amount variable to a value very close to 0 and then calls the _withdraw function with that value.

The require statement checks if the contract behaved incorrectly by verifying that the withdrawnAmount value is not equal to the amount value. If the contract behaved correctly, the require statement will throw an exception.

Tools Used : VS Code

Recommendations : To fix this issue, it's recommended to use a more robust comparison method, such as >= or <=, to account for potential precision issues or small differences between the values being compared.

Updated Code:

By using a more robust comparison method, the contract can ensure that the comparison is accurate even in the presence of precision issues or small differences between the values being compared.