Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

DoS on `withdraw` and `withdrawMax` When rpm is Very Low

mrkaplan

Summary

Setting an extremely small ratePerSecond value (e.g., 1) in a stream with a substantial balance (e.g., 50,000e6) can lead to a denial-of-service (DoS) issue in the withdraw and withdrawMax functions. When calculating the stream’s coveredDebt, the result will be zero—even if a significant amount of time has elapsed, such as one year. This occurs because the minimal rate does not allow enough balance to accumulate over time, effectively blocking any withdrawals despite the stream having available funds.

PoC

Paste this code on tests/integration/concrete/withdraw/withdraw.t.sol

function test_SmallRpmRevert()
external
{
// Go back to the starting point.
vm.warp({ newTimestamp: OCT_1_2024 });
​
resetPrank({ msgSender: users.sender });
// Max value of rate per second
UD21x18 rpm = UD21x18.wrap(1);
// Create the stream
uint256 streamId = createDefaultStream(rpm, usdc);
// We deposit more than enough
deposit(streamId, 50_000e6);
​
// Simulate the one year of streaming.
vm.warp({ newTimestamp: WARP_ONE_YEAR });
console.log("balance of the stream ID: ", flow.getBalance(streamId));
console.log("Covered debt of the stream ID: ", flow.coveredDebtOf(streamId));
​
uint128 amountToWithdraw = flow.coveredDebtOf(streamId);
resetPrank({ msgSender: users.recipient });
vm.expectRevert();
// Try withdraw or withdrawMax, it will revert
//(vars.actualWithdrawnAmount, vars.actualProtocolFeeAmount) = flow.withdrawMax(streamId, users.recipient);
(vars.actualWithdrawnAmount, vars.actualProtocolFeeAmount) =
flow.withdraw({ streamId: streamId, to: users.recipient, amount: amountToWithdraw});
console.log("Amount withrawn:", vars.actualWithdrawnAmount);
}
​

Recommendations

Establish a minimum allowable ratePerSecond to prevent this scenario.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.