Skip to content

Latest commit

 

History

History
43 lines (23 loc) · 1.47 KB

051.md

File metadata and controls

43 lines (23 loc) · 1.47 KB

Early Sepia Seal

Medium

Account abstraction wallets may not be able to cancel streams

Summary

When a stream is canceled, the associated NFT is sent back to the DAO, and the remaining funds of the stream are refunded to the user. These funds are sent using an arbitrary call, therefore smart contract wallets not implementing a fallback or receive methods will not be able to receive the ETH causing the transaction to fail.

Root Cause

The refund mechanism in StreamEscrow::cancelStream relies on a low-level call to transfer ETH to msg.sender:

(bool sent, ) = msg.sender.call{ value: amountToRefund }('');

https://github.com/sherlock-audit/2024-11-nounsdao/blob/main/nouns-monorepo/packages/nouns-contracts/contracts/StreamEscrow.sol#L182

Internal pre-conditions

No response

External pre-conditions

The auction winner or stream creator holds the Noun in a smart contract wallet that does not implement a fallback or receive function.

Attack Path

No response

Impact

Loss of accessibility to the remaining stream funds for affected users. The transaction to cancel the stream will revert, and users holding the corresponding Noun in smart contract wallets will be unable to retrieve their funds.

PoC

No response

Mitigation

Implement a system consistent with the rest of the codebase such as the use of _safeTransferETHWithFallback in NounsAuctionHouseV3, where the native ETH is wrapped into wETH if the transfer fails.