Streaming Protocol contest - Meta0xNull's results

Handle

Meta0xNull

Vulnerability details

Impact

     *  This is a potentially dangerous function so to ensure trustlessness, *all* balances
     *  that may matter are guaranteed to not change.

There are Pre and Post Token Check for Deposit Token and Reward Token. But there is no check for Incentives Tokens which mean the number of Incentive Tokens May Go Lower after the arbitrary Call.

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L728-L749

Tools Used

Manual Review

Recommended Mitigation Steps

    // external incentives to stream creator
    mapping (address => uint112) public incentives;

The Incentive Token Address and Amounts was stored in incentives. Thus, Just need to do a loop to compare Amounts in incentives Vs Token Balance in Contract Address at The End of arbitraryCall().

Handle

Meta0xNull

Vulnerability details

Impact

1. Alice want to Transfer Gov to Bob with setPendingGov() and now pendingGov = BobAddress
2. Bob Accept Gov via acceptGov()
3. Bob Tell Community He Want the Contract Become Trustless by Remove Governor via function __abdicate() and gov = address(0) now
4. Later, Bob Call acceptGov() again because pendingGov = BobAddress and Bob Become Gov Again

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L26-L30 https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L33-L38 https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L45-L49

Tools Used

Manual Review

Recommended Mitigation Steps

In acceptGov(), Set pendingGov to Zero Address Once Transfer Gov.

address old = gov; gov = pendingGov; pendingGov = address(0);