MEDIUM: resume_continuous_flow missing caller authentication — unauthorized flow rate changes

[leanworld7-netizen]

MEDIUM: resume_continuous_flow missing caller authentication — unauthorized flow rate changes

Function Affected

• resume_continuous_flow (L5554) — public, no caller require_auth()

Root Cause

resume_continuous_flow calls update_flow_rate (L2667) which uses env.current_contract_address().require_auth() (self-auth). When called as a direct entry point, this self-auth passes automatically. Any caller can change any stream's flow rate to any positive value.

Attack

1. Attacker calls resume_continuous_flow(victim_stream_id, 999999999)
2. update_flow_rate is called with attacker-supplied flow_rate_per_second
3. Stream's flow rate is set to 999999999 — stream depletes in seconds
4. Victim's stream balance is consumed at an accelerated rate

Impact

• Flow manipulation: Anyone can set any stream's flow rate to any value
• Accelerated depletion: High flow rates drain stream balances instantly
• Economic damage: Providers lose funds at attacker-controlled rates

Severity

MEDIUM — per SECURITY.md section 4.1, Medium = $1K-$5K bounty.

Fix

Add flow.provider.require_auth() before calling update_flow_rate.

[Jumongweb]

Hi maintainer, i will like to solve this issue

[Naajih09]

Hey maintainer, i have read your description and i have worked on several issues like this, kindly assign to me