Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Function depositAndPause() doesn't call the function _verifyStreamSenderRecipient to verify addresses.

oxtenma

Vulnerability Details

The function depositAndPause() is used to deposit tokens in a stream and pauses it. But other two function deposit() and depositViaBroker() calls the function _verifyStreamSenderRecipient to check whether the provided addresses mathces stream's sender and recipient in the contract SablierFlow contract.

function depositAndPause(
uint256 streamId,
uint128 amount
)
external
override
noDelegateCall
notNull(streamId)
notPaused(streamId)
onlySender(streamId)
updateMetadata(streamId)
{
// _verifyStreamSenderRecipient @audit why not called?
​
// Checks, Effects, and Interactions: deposit on stream.
_deposit(streamId, amount);
​
// Checks, Effects, and Interactions: pause the stream.
_pause(streamId);
}
​

Now the function depositAndPause() isn't calling the function _verifyStreamSenderRecipient() to check the addresses matches stream's sender recipient which is let users to put the addresses not related to the provided stream id. The requirement `sender` and `recipient` must match the stream's sender and recipient addresses will not be followed.

Impact

Altough sender is authorized in the modifier but the reciepient address isn't sanitized and recipient can be different than owner which isn't allowed.

​
function _verifyStreamSenderRecipient(uint256 streamId, address sender, address recipient) internal view {
if (sender != _streams[streamId].sender) {
revert Errors.SablierFlow_NotStreamSender(sender, _streams[streamId].sender);
}
​
if (recipient != _ownerOf(streamId)) {
revert Errors.SablierFlow_NotStreamRecipient(recipient, _ownerOf(streamId));
}
}

Tools Used

Manual Review

Recommendations

We recommend calling the function _verifyStreamSenderRecipient() while calling the depositAndPause() function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.