Streaming Protocol contest - gzeon's results

Handle

gzeon

Vulnerability details

Impact

The comment in https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L553 stated that:

Allows a receipt token holder (or original depositor in case of a sale) to claim their rewardTokens but the reward is only tracked to the original depositor in both case, see https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L558

        TokenStream storage ts = tokensNotYetStreamed[msg.sender];

Transferring the LockeERC20 token does not transfer the TokenStream state.

Handle

gzeon

Vulnerability details

Impact

There is an empty else block

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L443

Handle

gzeon

Vulnerability details

Impact

The flashloan function in Locke.sol check balances of both deposit and reward tokens. While this is certainly the safest approach, it seems unnecessary to check for the balance of the token that was NOT flashloaned.

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L696

Recommended Mitigation Steps

might consider rewrite to

function flashloan(address token, address to, uint112 amount, bytes memory data) public lock {
        require(token == depositToken || token == rewardToken, "erc");

        uint256 preTokenBalance = ERC20(token).balanceOf(address(this));
        ERC20(token).safeTransfer(to, amount);

        // the `to` contract should have a public function with the signature:
        // function lockeCall(address initiator, address token, uint256 amount, bytes memory data);
        LockeCallee(to).lockeCall(msg.sender, token, amount, data);

        uint256 postTokenBalance = ERC20(token).balanceOf(address(this));

        uint112 feeAmt = amount * 10 / 10000; // 10bps fee
        require(preTokenBalance + feeAmt <= postTokenBalance, "f1");

        if (token == depositToken) {
            depositTokenFlashloanFeeAmount += feeAmt;
        } else {
            rewardTokenFeeAmount += feeAmt;
        }

        emit Flashloaned(token, msg.sender, amount, feeAmt);
    }

Handle

gzeon

Vulnerability details

Impact

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L403 can be re-written from

            rewardTokenFeeAmount += feeAmt;
            rewardTokenAmount += amt;
        } else {
            amt = amount;
            rewardTokenAmount += amt;
        }

to

            rewardTokenFeeAmount += feeAmt;
        } else {
            amt = amount;
        }
        rewardTokenAmount += amt;

to reduce cdoe size

Handle

gzeon

Vulnerability details

Impact

Currently createStream in StreamFactory deploy a new Stream and LockeERC20 contract for every new Stream. We can instead deploy a minimal proxy point to the Stream implementation to save significant gas on createStream.

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L822