Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Bera Contracts>Threat Model>Function: claimRewards(uint256 streamId)
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionEnforce a more recent Solidity versionThe paymaster has a simple typo on the endpoint
DesignPaymaster
Threat ModelWhat are threat models?Distributor1.sol
StreamingNFT.solFunction: claimBatchRewards(uint256[] calldata streamIds)Function: claimRewards(uint256 streamId)Function: createBatchStream(uint256[] calldata tokenIds, address onBehalfOfOwner)Function: createStream(uint256 tokenId)
Audit ResultsAssessment Results

Function: claimRewards(uint256 streamId)

The function is used to transfer the rewards to the NFT owner until the vesting period is finished.

Inputs

  • streamId

    • Validation: A stream must be created to claim rewards.

    • Impact: It prevents claiming rewards for a stream that has not started.

Branches and code coverage (including function calls)

Intended branches

  • Rewards are claimed by the owner of the NFT for a stream already created. The vested awards are properly transferred to the beneficiary.

  • Rewards are claimed by a third party for a stream already created. The vested awards are properly transferred to the beneficiary.

Negative behavior

  • Claiming rewards during the same block gives zero rewards.

  • Claiming rewards for an invalid NFT reverts.

  • Claiming rewards after the vesting period gives zero rewards.

  • A transfer failure makes the transaction revert.

Function call analysis

  • _claimVestedRewards(streamId, vestingEndBlock_)

    • External/Internal? Internal.

    • Argument control? streamId.

    • Impact: Computes and returns the value of the rewards depending on the current block number.

Zellic © 2025Back to top ↑