@@ -5,12 +5,12 @@ design and testing of the protocol to guarantee its safety and reliability. Howe
55continuous process. If you believe you have found a security vulnerability, please read the
66[ Bug Bounty Program] ( https://sablier.notion.site/bug-bounty ) and share a report privately with us.
77
8- ## Protocol Assumptions
8+ ## Common Protocol Assumptions
99
10- Flow has been developed with a number of technical assumptions in mind. For a disclosure to qualify as a vulnerability,
11- it must adhere to the following assumptions:
10+ All Sablier protocols have been developed with a number of common technical assumptions in mind. For a disclosure to
11+ qualify as a vulnerability, it must adhere to these assumptions:
1212
13- - The total supply of any ERC-20 token remains below $(2^{ 128} - 1)$ , i.e., ` type(uint128).max ` .
13+ - The total supply of any ERC-20 token remains below 2< sup > 128</ sup > - 1, i.e., ` type(uint128).max ` .
1414- The ` transfer ` and ` transferFrom ` methods of any ERC-20 token strictly reduce the sender's balance by the transfer
1515 amount and increase the recipient's balance by the same amount. In other words, tokens that charge fees on transfers
1616 are not supported.
@@ -21,6 +21,17 @@ it must adhere to the following assumptions:
2121 [ $POL token] ( https://polygonscan.com/address/0x0000000000000000000000000000000000001010 ) on Polygon is not supported.
2222- The token contract has only one entry point.
2323- The token contract does not allow callbacks (e.g., ERC-777 is not supported).
24+
25+ ## Airdrops
26+
27+ Sablier Airdrops has been developed with the following additional assumptions:
28+
29+ - Campaign creator does not fund an Airdrop campaign contract before deploying it through the Sablier Merkle Factory.
30+
31+ ## Flow
32+
33+ Flow has been developed with the following additional assumptions:
34+
2435- A trust relationship is formed between the sender, recipient, and depositors participating in a stream. The recipient
2536 depends on the sender to fulfill their obligation to repay any debts incurred by the Flow stream. Likewise, depositors
2637 trust that the sender will not abuse the refund function to reclaim tokens.
@@ -31,3 +42,13 @@ it must adhere to the following assumptions:
3142- There could be a minor discrepancy between the actual streamed amount and the expected amount. This is due to ` rps `
3243 being an 18-decimal number, while users provide the amount per interval in the UI. If ` rps ` had infinite decimals,
3344 this discrepancy would not occur.
45+
46+ ## Lockup
47+
48+ Sablier Lockup has been developed with the following additional assumptions:
49+
50+ - The number of segments/tranches should be such that creating a stream should not lead to an overflow of the block gas
51+ limit.
52+ - There is no need for exponents greater than ~ 18.44 in ` LockupDynamic ` segments.
53+ - Recipient contracts on the hook allowlist have gone through due diligence and are assumed to expose no risk to the
54+ Sablier protocol.
0 commit comments