Skip to content

Latest commit

 

History

History
45 lines (23 loc) · 1.63 KB

009.md

File metadata and controls

45 lines (23 loc) · 1.63 KB

Broad Mint Aardvark

High

ethStreamedPerTick does not get reset to zero.

Summary

In the forwardAll function inStreamsEscrow.sol, the state variable ethStreamedPerTick is not reset after each execution. This omission will result in the accumulation of ETH values from previous stream cycles, leading to erroneous financial transfers in subsequent periods. The value of ethStreamedPerTick should be cleared after each forward operation to ensure that future cycles are correctly calculated and managed.

https://github.com/sherlock-audit/2024-11-nounsdao/blob/main/nouns-monorepo/packages/nouns-contracts/contracts/StreamEscrow.sol#L136

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

ETH accumulated from previous streams may be carried over into future cycles, resulting in excessive ETH being transferred to the treasury or recipients beyond the intended amount.

Future streams will inherit incorrect values for ethStreamedPerTick, potentially causing an improper allocation of ETH across streams, leading to financial mismanagement.

If the ethStreamedPerTick value grows such that an attempted transfer to Treasury reverts due to insufficient funds, then it affects the progression of the system because currentTick cannot be incremented

PoC

No response

Mitigation

reset the ethStreamedPerTick to zero at the end of the forwardAll function to ensure that the accumulated ETH from the previous cycle does not carry over. This will guarantee that each cycle starts fresh, reflecting only the active streams for that cycle.