Submitted by hyh
Any airdrop gathered with arbitraryCall will be immediately lost as an attacker can track arbitraryCall transactions and back run them with calls to recoverTokens, which doesnt track any tokens besides reward, deposit and incentive tokens, and will give the airdrop away.
arbitraryCall requires that tokens to be gathered shouldnt be reward, deposit or incentive tokens:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L735
Also, the function doesnt mark gathered tokens in any way. Thus, the airdrop is freely accessible for anyone to be withdrawn with recoverTokens:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L687
Add airdrop tokens balance mapping, record what is gathered in arbitraryCall and prohibit their free withdrawal in recoverTokens similarly to incentives[].
Now:
To be:
brockelmore (Streaming Protocol) disputed:
0xean (judge) commented:
