The calculateAmountsFromFee
function in the Helpers
library can encounter an underflow error when small values of totalAmount
are input. This occurs because the calculated feeAmount
, derived from the specified fee percentage, may round to a value equal to or exceeding totalAmount
. When feeAmount
is subtracted from totalAmount
to calculate netAmount
, this causes a revert due to underflow. This flaw can disrupt operations dependent on calculateAmountsFromFee
, as seen in the _withdraw
function, potentially impacting withdrawal functionality.
https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/libraries/Helpers.sol#L13
https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/SablierFlow.sol#L848
Impact:
If the underflow occurs, the _withdraw
function may revert, denying users
the ability to withdraw small amounts from their streams. This can impair user experience, especially in cases involving low stream balances, though it does not lead to a direct loss of funds.
Proof of Concept:
Used an existing test suite in the withdraw.t.sol
under the concrete
folder.
Here you can see that the protocolFeeAmount > withdrawAmount
.
When the following function is executed using forge test --mt test_WhenCallerRecipient -vvvvv
.
These are the following error logs:
Meaning that an underflow revert was reached.
Recommended Mitigation:
Introduce a check in calculateAmountsFromFee
to verify that feeAmount
does not exceed totalAmount
. If feeAmount
equals or surpasses totalAmount
, netAmount
should be set to zero, or a specific error should be returned, indicating the amount is too small for fee deduction.
So in the Helpers.sol
place this changes in the calculateAmountsFromFee
function in the Helpers
lib.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.