Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Bera Contracts>Threat Model>Function: createStream(uint256 tokenId)
GeneralOverview
Findings
Critical (1)
Medium (2)
Low (1)
DiscussionEnforce a more recent Solidity versionThe paymaster has a simple typo on the endpoint
DesignPaymaster
Threat ModelWhat are threat models?Distributor1.sol
StreamingNFT.solFunction: claimBatchRewards(uint256[] calldata streamIds)Function: claimRewards(uint256 streamId)Function: createBatchStream(uint256[] calldata tokenIds, address onBehalfOfOwner)Function: createStream(uint256 tokenId)
Audit ResultsAssessment Results

Function: createStream(uint256 tokenId)

The function creates a stream for the owner of a credentialNFT. An allocation is transferred to the owner of the NFT, and a fee is transferred if the caller of the function is not the NFT's owner.

Inputs

  • tokenId

    • Validation: A stream was not already created for the current token identifier. The current block number is checked to be greater than vestingStartBlock. The tokenId is checked to be a valid credentialNFT by the ownerOf function.

    • Impact: It should prevent the creation of a stream twice or the creation of a stream for a nonexisting NFT.

Branches and code coverage (including function calls)

Intended branches

  • A stream is created by the owner of the NFT. The instant amount is properly transferred.

  • A stream is created by another user. The instant amount and the fees are properly transferred.

Negative behavior

  • A stream created for the second time reverts.

  • A stream created before the vesting starts reverts.

  • A stream created for an invalid identifier reverts.

  • A transfer failure during a stream creation reverts.

Function call analysis

  • transfer(tx.origin, gasFee)

    • External/Internal? Internal.

    • Argument control? No.

    • Impact: Transfers the fees.

  • transfer(onbehalfOf, instantAmount)

    • External/Internal? Internal.

    • Argument control? No.

    • Impact: Transfers the amount of the stream creation.

Zellic © 2025Back to top ↑