Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect calculation when rate changes in _ongoingDebtScaledOf

kwakudr

Summary

Incorrect calculation when rate changes in _ongoingDebtScaledOf

Vulnerability Details

/// @dev Calculates the ongoing debt, as a 18-decimals fixed point number, accrued since last snapshot. Return 0 if
/// the stream is paused or `block.timestamp` is less than or equal to snapshot time.
function _ongoingDebtScaledOf(uint256 streamId) internal view returns (uint256) {
uint256 blockTimestamp = block.timestamp;
uint256 snapshotTime = _streams[streamId].snapshotTime;
​
​
uint256 ratePerSecond = _streams[streamId].ratePerSecond.unwrap();
​
​
// Check:if the rate per second is zero or the `block.timestamp` is less than the `snapshotTime`.
if (ratePerSecond == 0 || blockTimestamp <= snapshotTime) {
return 0;
}
​
​
uint256 elapsedTime;
​
​
// Safe to use unchecked because subtraction cannot underflow.
unchecked {
// Calculate time elapsed since the last snapshot.
elapsedTime = blockTimestamp - snapshotTime;
}
​
​
// Calculate the ongoing debt scaled accrued by multiplying the elapsed time by the rate per second.
return elapsedTime * ratePerSecond;
}

The function assumes a constant rate throughout the entire period from snapshotTime to block.timestamp. However, if there was a rate change during this period, the calculation will be incorrect because it:

  1. Only uses the current rate (_streams[streamId].ratePerSecond)

  2. Applies this rate to the entire period

  3. Ignores the historical rate that was active for part of the period

Time: [Start]---------------[End]

Rate: 100 tokens/second (constant)

Period: 100 seconds

Debt: 100 * 100 = 10,000 tokens

Time: [Start]-----[Rate Change]-----[End]

Rate: 100 tokens/s -> 200 tokens/s

Period: 50s at 100/s + 50s at 200/s

Expected: (50 * 100) + (50 * 200) = 15,000 tokens

Actual: 100s * 200 = 20,000 tokens (incorrect)

Impact

The total debt will be wrong if any rate changes occurred. Users might withdraw incorrect amounts. Protocol-wide accounting will be inaccurate

Tools Used

Manual Review

Recommendations

Track all rate changes in a period

Calculate debt separately for each sub-period

Sum up the total correctly accounting for different rates

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.