Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Bera Contracts>Threat Model>Function: claimBatchRewards(uint256[] calldata streamIds)
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionEnforce a more recent Solidity versionThe paymaster has a simple typo on the endpoint
DesignPaymaster
Threat ModelWhat are threat models?Distributor1.sol
StreamingNFT.solFunction: claimBatchRewards(uint256[] calldata streamIds)Function: claimRewards(uint256 streamId)Function: createBatchStream(uint256[] calldata tokenIds, address onBehalfOfOwner)Function: createStream(uint256 tokenId)
Audit ResultsAssessment Results

Function: claimBatchRewards(uint256[] calldata streamIds)

The function is used to transfer the rewards for a batch of NFTs until the vesting period is finished.

Inputs

  • streamIds

    • Validation: A stream must be created for each identifier to claim rewards.

    • Impact: It prevents claiming rewards for streams that have not started.

Branches and code coverage (including function calls)

Intended branches

  • Rewards are claimed by the owner of the NFTs for streams already created. The vested awards are properly transferred to the beneficiary.

  • Rewards are claimed by a third party for streams already created. The vested awards are properly transferred to the beneficiary.

Negative behavior

  • Claiming rewards during the same block gives zero rewards.

  • Claiming rewards for invalid NFTs reverts.

  • Claiming rewards after the vesting period gives zero rewards.

  • A transfer failure makes the transaction revert.

Function call analysis

  • _claimVestedRewards(streamIds[i], vestingEndBlock_)

    • External/Internal? Internal.

    • Argument control? streamIds.

    • Impact: Computes and returns the value of the rewards depending on the current block number.

Zellic © 2025Back to top ↑