HIGH: withdraw_continuous missing caller authentication — anyone can drain stream balances

[leanworld7-netizen]

HIGH: withdraw_continuous missing caller authentication — anyone can drain stream balances

Function Affected

• withdraw_continuous (L7601) — public, zero require_auth() on caller

Root Cause

withdraw_continuous calls withdraw_from_flow (L2849) with no authentication check on the caller. The internal function only validates withdrawal_amount > 0 and accumulated_balance >= withdrawal_amount. Any caller can drain any stream's accumulated balance.

Attack

1. Attacker calls withdraw_continuous(victim_stream_id, stream_balance)
2. withdraw_from_flow subtracts withdrawal_amount from flow.accumulated_balance
3. Stream balance is zeroed — legitimate provider cannot withdraw their own funds
4. Attacker repeats across all streams

Impact

• Fund destruction: Stream accumulated_balance is reduced to zero for all streams
• Provider lockout: Legitimate providers lose access to their accumulated earnings
• No gain for attacker — pure griefing/DoS, but financial damage to all stream providers is real

Severity

HIGH — per SECURITY.md section 4.1, High = $5K-$10K bounty.

Fix

Add flow.provider.require_auth() before calling withdraw_from_flow.

[apatafamilycompound123-ops]

Hi, I'd like to work on this issue. I've gone through the description and acceptance criteria and I'm confident I can deliver it. I'll make sure every acceptance criterion is met and submit a clean, tested PR. Please assign it to me.

[omeruahelisha8-png]

Hi Maintainer,
I've carefully read the requirements and I'm prepared to work on this issue.
I'd appreciate it if you could assign it to me. Thank you!

[warisu]

I have thoroughly read the docs on the impact, how to fix it, etc. And i am super confident that i deliver the PR within 2 days