Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

create and adjustratepersecond missing maximum bound

kwakudr

Summary

create and adjustratepersecond missing maximum bound

Vulnerability Details

function _create(
address sender,
address recipient,
UD21x18 ratePerSecond,
IERC20 token,
bool transferable
)
internal
returns (uint256 streamId)
{
// Check: the sender is not the zero address.
if (sender == address(0)) {
revert Errors.SablierFlow_SenderZeroAddress();
}
​
​
uint8 tokenDecimals = IERC20Metadata(address(token)).decimals();
​
​
// Check: the token decimals are not greater than 18.
if (tokenDecimals > 18) {
revert Errors.SablierFlow_InvalidTokenDecimals(address(token));
}
function _adjustRatePerSecond(uint256 streamId, UD21x18 newRatePerSecond) internal {
// Check: the new rate per second is different from the current rate per second.
if (newRatePerSecond.unwrap() == _streams[streamId].ratePerSecond.unwrap()) {
revert Errors.SablierFlow_RatePerSecondNotDifferent(streamId, newRatePerSecond);
}
​
​
uint256 ongoingDebtScaled = _ongoingDebtScaledOf(streamId);
​
​
// Update the snapshot debt only if the stream has ongoing debt.
if (ongoingDebtScaled > 0) {
// Effect: update the snapshot debt.
_streams[streamId].snapshotDebtScaled += ongoingDebtScaled;
}
​
​
// Effect: update the snapshot time.
_streams[streamId].snapshotTime = uint40(block.timestamp);
​
​
// Effect: set the new rate per second.
_streams[streamId].ratePerSecond = newRatePerSecond;
}

The create function does not check for maximum bound in the ratePerSecond param. It only checks for valid sender and token decimals amongst others. In the _adjustRatePerSecond function, it only checks if the rate is different but doesn't again check for the maximum bound. Rates can be adjusted really high which would lead to overflow risk // In _ongoingDebtScaledOf````uint256 elapsedTime = blockTimestamp - snapshotTime;````return elapsedTime * ratePerSecond; // Could overflow with extreme rates

and precision loss // High rates could lead to significant precision loss in calculations````uint256 solvencyAmount = balanceScaled - snapshotDebtScaled + oneMVTScaled;````uint256 solvencyPeriod = solvencyAmount / ratePerSecond;

Example Scenario:

Stream Balance: 1000 tokens

Rate: 1000 tokens/second

Result: Entire balance depleted in 1 second

Impact

precision loss and overflow risk against users.

Tools Used

Manual Review

Recommendations

Add Rate Validation in Creation. Rate Validation in Adjustment

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.