Flow

Summary

The withdraw function lacks access control, allowing any external account to call it and withdraw funds from any stream by providing a valid streamId, to address, and amount. Without an onlySender or equivalent ownership check, malicious actors can withdraw funds from any stream, leading to unauthorized fund transfers and potential financial loss

Vulnerability Details

Impact

Unauthorized Fund Withdrawals: An attacker could exploit this to drain funds from streams they do not own.

• Financial Loss: Users can suffer significant financial losses as funds are withdrawn by unauthorized parties

Vulnerable code

Proof of Concept (PoC)

A practical scenario demonstrating the exploit:

1. Assume Alice owns a stream with streamId = 1 and has deposited 1000 tokens.

2. An attacker, Mallory, executes the following script:

Result: Mallory successfully withdraws the entire balance from Alice’s stream without being the owner.

Tools Used

Manual Review

Recommendations

To fix this issue, implement access control to restrict the withdraw function so that only the stream owner can withdraw funds:

1. Add onlySender Modifier: Include a modifier that checks if msg.sender is the owner of streamId and apply it to the withdraw function:

2. Use Role-Based Access Control (if multiple user roles need access): Consider OpenZeppelin’s AccessControl for fine-grained permissions.