Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Possible cases allowing anyone to void or withdrawing from a stream

shaping_myself

Vulnerability Details

_isCallerStreamRecipientOrApproved()is called inside _void()

function _void(uint256 streamId) internal {
// Check: `msg.sender` is either the stream's sender, recipient or an approved third party.
> if (msg.sender != _streams[streamId].sender && !_isCallerStreamRecipientOrApproved(streamId)) {
revert Errors.SablierFlow_Unauthorized({ streamId: streamId, caller: msg.sender });
}
...

Same situation happens during _withdraw()

function _withdraw(
uint256 streamId,
address to,
uint128 amount
)
internal
returns (uint128 withdrawnAmount, uint128 protocolFeeAmount)
{
...
​
// Check: `msg.sender` is neither the stream's recipient nor an approved third party, the withdrawal address
// must be the recipient.
> if (to != _ownerOf(streamId) && !_isCallerStreamRecipientOrApproved(streamId)) {
revert Errors.SablierFlow_WithdrawalAddressNotRecipient({ streamId: streamId, caller: msg.sender, to: to });
}

Here inside _isCallerStreamRecipientOrApproved(), the msg.senderwill be the SablierFlow contract & not the actual caller.

function _isCallerStreamRecipientOrApproved(uint256 streamId) internal view returns (bool) {
address recipient = _ownerOf(streamId);
return msg.sender == recipient || isApprovedForAll({ owner: recipient, operator: msg.sender })
|| getApproved(streamId) == msg.sender;
}

Impact

If the SablierFlow contract is approved or the recipient, then anyone call void()to end the stream because when the call enters _isCallerStreamRecipientOrApproved()from the SablierFlow contract, the caller is msg.senderis changed from the actual caller to the SablierFlow contract's address.

Tools Used

Manual Review

Recommendations

Add an addition parameter which checks the actual address of the caller instead of msg.sender.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.