OlaHamid - Denial of Service in cancelStreams Due to Single Failing nounId

[sherlock-admin4]

OlaHamid

Medium

Denial of Service in cancelStreams Due to Single Failing nounId

Permalink

• [StreamEscrow.sol#L155](https://github.com/sherlock-audit/2024-11-nounsdao/blob/8b6fb94f103134e751cf016e5c3f4185be89bb49/nouns-monorepo/packages/nouns-contracts/contracts/StreamEscrow.sol#L155)

---

SUMMARY

The fastForwardMultipleStreams function processes arrays of nounIds and ticksToForward to fast-forward multiple streams. However, the function lacks ownership validation for the nounIds before calling fastForwardStream(nounIds[i], ticksToForward[i]). This allows for unintended or unauthorized manipulation of streams by callers who do not own the nounIds in question.

---

ROOT CAUSE

The absence of a check to ensure the caller owns each nounId being processed leads to potential misuse of the fastForwardMultipleStreams function.

---

PRECONDITIONS

Internal Precondition

1. The fastForwardStream function does not verify ownership of the nounId.

External Precondition

1. A caller supplies an array of nounIds they do not own.

---

ATTACK PATH

1. A malicious user calls fastForwardMultipleStreams with an array of nounIds, including IDs they do not own.
2. The function processes these IDs without validating ownership, potentially impacting streams belonging to other users.

---

IMPACT

• Unauthorized manipulation of streams owned by other users.
• Potential disruption or misuse of streams, impacting system integrity.

---

PROOF OF CONCEPT (PoC)

---

MITIGATION

Add ownership validation for each nounId in the fastForwardMultipleStreams loop:

function fastForwardMultipleStreams(uint256[] calldata nounIds, uint32[] calldata ticksToForward) external {
    require(nounIds.length == ticksToForward.length, "length mismatch");
    for (uint256 i; i < nounIds.length; ++i) {
        require(msg.sender == nounsToken.ownerOf(nounIds[i]), "Caller does not own nounId");
        fastForwardStream(nounIds[i], ticksToForward[i]);
    }
}

---