CRITICAL: pause_continuous_flow and update_continuous_flow_rate missing user authentication

[leanworld7-netizen]

CRITICAL: pause_continuous_flow and update_continuous_flow_rate missing user authentication

Functions Affected

• pause_continuous_flow (L5549) — no require_auth() on caller
• update_continuous_flow_rate (L5497) — no require_auth() on caller

Root Cause

Both public functions call internal update_flow_rate (L2667) which does env.current_contract_address().require_auth() (L2676). This is self-auth — it validates the contract calling itself, NOT the user invoking the public function. In Soroban, when a function is called as an entry point, self-auth passes automatically. No user-level authorization is ever checked.

Impact

1. DoS: Anyone can call pause_continuous_flow to pause ANY active payment stream, halting all payments.
2. Rate manipulation: Anyone can call update_continuous_flow_rate to change any stream's flow rate to any non-negative value, accelerating or slowing payment streams.
3. Fund drainage: Setting a very high flow rate drains the stream balance to the recipient faster than intended.

Severity

CRITICAL — per SECURITY.md section 4.1, Critical = $10K-$50K bounty.

Fix

Add flow.provider.require_auth() (or flow.recipient.require_auth() for rate changes) before calling update_flow_rate.

[Jumongweb]

Hi maintainer, i will like to solve this issue