code-423n4 / 2021-11-streaming-findings

0 stars 0 forks source link

global unstreamed value is not updated after stream depositor withdraws an amount #270

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

hubble

Vulnerability details

Impact

Value of unstreamed public variable is not correct after stream depositor withdraws an amount before end of the stream.

Proof of Concept

File :Locke.sol Contract / Function : Stream / withdraw Line : 469 totalVirtualBalance -= virtualBal; depositTokenAmount -= amount;

Tools Used

Manual review

Recommended Mitigation Steps

Add a line to update the value of unstreamed like below

File :Locke.sol Contract / Function : Stream / withdraw Line : 469

    totalVirtualBalance -= virtualBal;
    depositTokenAmount -= amount;
    unstreamed -= amount;

0xean commented 2 years ago

dupe of #118