Skip to content

Latest commit

 

History

History
39 lines (20 loc) · 879 Bytes

041.md

File metadata and controls

39 lines (20 loc) · 879 Bytes

Spare Flaxen Terrier

High

Missing check ownership of function forwardAll()

Summary

The missing check of owner of this function has reentrancy attack risk. And also everyone can call this function to do forwardAll() if time is required. The only check is block.time should be at least mimimumTickDuration, while it's not enough.

Root Cause

https://github.com/sherlock-audit/2024-11-nounsdao/blob/main/nouns-monorepo/packages/nouns-contracts/contracts/StreamEscrow.sol#L136-L149

If the attacker has the condition of wait time of minimumTickDuration to do reentrancy attack, the forwardAll function will not defend it. And the money will be sent to ethRecipient.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

No response