Recipient can prevent the payer from the cancelation via DOS (ERC777)

Summary

Some ERC20 tokens (e.g. ERC777) allow hook implementation on receiving tokens. A malicious recipient can cause DOS and force the payer to pay the full amount of the stream.

Vulnerability Detail

The protocol allows a payer to cancel the stream using the function cancel().

function cancel() external onlyPayerOrRecipient {
    address payer_ = payer();
    address recipient_ = recipient();
    IERC20 token_ = token();

    uint256 recipientBalance = balanceOf(recipient_);

    // This zeroing is important because without it, it's possible for recipient to obtain additional funds
    // from this contract if anyone (e.g. payer) sends it tokens after cancellation.
    // Thanks to this state update, `balanceOf(recipient_)` will only return zero in future calls.
    remainingBalance = 0;

    if (recipientBalance > 0) token_.safeTransfer(recipient_, recipientBalance);

    // Using the stream's token balance rather than any other calculated field because it gracefully
    // supports cancelling the stream even if payer hasn't fully funded it.
    uint256 payerBalance = tokenBalance();
    if (payerBalance > 0) {
        token_.safeTransfer(payer_, payerBalance);
    }

    emit StreamCancelled(msg.sender, payer_, recipient_, payerBalance, recipientBalance);
}

Note that the protocol will try to send the fair recipient balance first at L#23. But a malicious recipient can implement a hook that reverts as long as it did not receive the full amount. This makes it impossible for a payer to cancel the stream and he is forced to pay the full amount.

Impact

A recipient can force a payer to pay the full amount by causing DOS for the cancelation.

Code Snippet

https://github.com/sherlock-audit/2022-11-nounsdao/blob/main/src/Stream.sol#L249

Tool used

Manual Review

Recommendation

It is recommended to adopt a withdrawal pattern.

Instead of transferring the tokens directly to the recipient's address during cancelation, save the amount that the recipient is entitled to in a state variable.

This will give payers more assurance and confidence about the security of their funds being used for a stream.

Duplicate of #38

sherlock-audit / 2022-11-nounsdao-judging

hansfriese - Recipient can prevent the payer from the cancelation via DOS (ERC777) #68