who in updateStreamInternal

[code423n4]

Handle

pauliax

Vulnerability details

Impact

function updateStreamInternal accepts a parameter 'who' but uses msg.sender when accessing the stream:

  function updateStreamInternal(address who) internal {
    ...
    TokenStream storage ts = tokensNotYetStreamed[msg.sender];

This will not update the expected stream when who != msg.sender. Currently, this function is only called from within the modifier, and the modifier is applied with msg.sender only, but still this risk needs to be addressed.

Recommended Mitigation Steps

Consider either updating 'who', or totally getting rid of this parameter to avoid confusion.

[brockelmore]

gas optimization

[brockelmore]

duplicate #125