arbitraryCall() Unable to Guarantee Incentives Tokens Not Change

[code423n4]

Handle

Meta0xNull

Vulnerability details

Impact

     *  This is a potentially dangerous function so to ensure trustlessness, *all* balances
     *  that may matter are guaranteed to not change.

There are Pre and Post Token Check for Deposit Token and Reward Token. But there is no check for Incentives Tokens which mean the number of Incentive Tokens May Go Lower after the arbitrary Call.

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L728-L749

Tools Used

Manual Review

Recommended Mitigation Steps

    // external incentives to stream creator
    mapping (address => uint112) public incentives;

The Incentive Token Address and Amounts was stored in incentives. Thus, Just need to do a loop to compare Amounts in incentives Vs Token Balance in Contract Address at The End of arbitraryCall().

[brockelmore]

This one doesnt provide the exploit mechanism like in #107 so I am inclined to not have this be part of that because this isn't actually a helpful issue for identifying or fixing the real issue.

[0xean]

dupe of #199