Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Rebasing Token and Fee on Transfer Issues in Sablier Flow

kwakudr

Summary

Rebasing Token and Fee on Transfer Issues in Sablier Flow

Vulnerability Details

function _deposit(uint256 streamId, uint128 amount) internal {
// Check: the deposit amount is not zero.
if (amount == 0) {
revert Errors.SablierFlow_DepositAmountZero(streamId);
}
​
​
IERC20 token = _streams[streamId].token;
​
​
// Effect: update the stream balance.
_streams[streamId].balance += amount;
​
​
unchecked {
// Effect: update the aggregate balance.
aggregateBalance[token] += amount;
}
​
​
// Interaction: transfer the amount.
token.safeTransferFrom({ from: msg.sender, to: address(this), value: amount });
​
​
// Log the deposit.
emit ISablierFlow.DepositFlowStream({ streamId: streamId, funder: msg.sender, amount: amount });
}

A rebasing token is one where the token supply (and thus user balances) automatically adjusts (increases or decreases) periodically. Common examples include:

Ampleforth (AMPL): Rebases every 24 hours

OHM: Rebases every 8 hours

AAVE staking tokens: Continuous positive rebase.

Balance Tracking Discrepancy

// What happens during a positive rebase:

Initial deposit: 100 tokens
After 10%

rebase: Contract has 110 tokens

Tracked balance: Still shows 100 tokens

// Result: 10 tokens unaccounted for or lost

Similar argument can be made for fee on transfer tokens like safemoon, RFI tokens and even USDT on some chains.

Impact

Incorrect accounting tracking and states for rebase tokens and fee on transfer tokens.

Tools Used

Manual Review

Recommendations

Track nominal and actual balances separately. Implement rebase detection mechanisms. Use safety margins for withdrawals

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.