CRITICAL: add_continuous_balance zero auth - anyone can inflate any payment stream balance

[leanworld7-netizen]

CRITICAL: Unauthenticated Balance Inflation in Continuous Flow Streams

Affected Function

add_continuous_balance (L5506) -> delegates to add_balance_to_flow (L2817)

Description

add_continuous_balance is a public entry point with zero require_auth() on either the wrapper or its internal delegate add_balance_to_flow.

Unlike update_flow_rate which has env.current_contract_address().require_auth() at L2676, add_balance_to_flow (L2817-L2846) has NO auth check whatsoever - it simply fetches the flow, adds additional_balance to flow.accumulated_balance, and stores it.

Attack

1. Attacker calls add_continuous_balance(env, victim_stream_id, 1_000_000)
2. add_balance_to_flow inflates flow.accumulated_balance by 1,000,000 with no token deposit
3. The stream now has 1,000,000 extra units of accumulated_balance
4. When the stream recipient claims or sweep_dust runs, tokens are transferred from the contract shared token pool - stealing from legitimate depositors

Comparison

• update_flow_rate (L2676): has env.current_contract_address().require_auth() - partial protection via self-auth
• add_balance_to_flow (L2817): NO auth of any kind - confirmed unprotected

Impact

• Any caller can inflate any stream balance without depositing tokens
• Draws from the contract shared token pool when claims are processed
• Scalable - attacker can target multiple streams

Severity: CRITICAL

No authentication required. Direct theft from shared pool.

Fix

Add flow.provider.require_auth() to add_continuous_balance wrapper before calling add_balance_to_flow.

Also recommend adding flow.provider.require_auth() to update_continuous_flow_rate (L5497), pause_continuous_flow (L5549), and resume_continuous_flow (L5554).

[Jumongweb]

Hi maintainer, i will like to solve this issue