Platform: Code4rena
Start Date: 30/11/2021
Pot Size: $100,000 USDC
Total HM: 15
Participants: 36
Period: 7 days
Judge: 0xean
Total Solo HM: 4
Id: 62
League: ETH
Rank: 21/36
Findings: 2
Award: $1,417.60
🌟 Selected for report: 1
🚀 Solo Findings: 0
Ruhum
The user has the possibility of creating a stream where the reward and deposit token are the same. This would potentially break the claiming of the deposit and the reward since the contract might not have enough funds.
Anyway, it would be the stream creator's fault but I think outright blocking that scenario would be the best approach here.
No checks whether depositToken and rewardToken are the same:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L809-L814
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L281-L310
none
Add following check to either createStream() or Stream.constructor()
require(rewardToken != depositToken)
#0 - 0xean
2022-01-16T01:12:20Z
dupe of #215
🌟 Selected for report: Ruhum
805.8152 USDC - $805.82
Ruhum
The stream creator has the ability to recover tokens that the contract didn't account for using the recoverTokens() function. Through the arbitraryCall() function, the governance contract could potentially also withdraw those tokens to an arbitrary address. Thus, the governance contract would be able to take the stream creator's tokens.
Both parties have access so it's a matter of who comes first.
recoverTokens() with which the stream creator can withdraw those tokens:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L687-L690
arbitraryCall() where the call has to be made to the ERC20 token contract's transfer() function. The recipient address and the amount can be determined by the caller, i.e. governance contract:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L743
none
I don't have a solution either
#0 - brockelmore
2021-12-06T16:48:12Z
I mean yes, but should be considered non critical imo
#1 - 0xean
2022-01-16T01:14:29Z
Will leave as low risk since it's worth highlighting the potential scenario and the implications of it.