Sablier / PRBProxy — Owner can be temporarily changed within proxy calls

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing. Standalone Foundry PoC and full write-up: 54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing_exp in the evm-hack-registry mirror.

Vulnerability classes: admin-takeover · direct-drain · known-pattern

Reproduction: self-contained Foundry PoC with only forge-std — no fork. output.txt · test/54672-…sol.

AuditVault taxonomy: lang/solidity · platform/cantina · severity/high · sector/streaming · sector/staking · genome: unbounded-loop · direct-drain · admin-takeover · known-pattern

Key info#


Impact	HIGH — mid-call owner swap steals stream cancel refunds (and any owner-gated action)
Protocol	Sablier (PRBProxy) — `_safeDelegateCall`
Vulnerable code	End-of-call `if (owner_ != owner) revert` only
Bug class	Transient storage ownership / TOCTOU on owner
Finding	Cantina — Sablier, Jul 2023 · #54672 · reporter Zach Obront
Report	cantina_sablier_jul2023.pdf
Source	AuditVault
Fix	Immutable / non-transferable owner, or registry-based ownership checks
Compiler	`^0.8.24` (PoC)

TL;DR#

execute DELEGATECALLs a target and only checks that owner is unchanged after return.
The target overwrites storage slot 0 (owner) mid-call to a colluding contract.
That temporary owner re-enters execute to cancel streams and sweep refunds.
Original owner is restored so the final check passes — theft succeeds silently.

Diagrams#

flowchart TD A["Alice: proxy.execute ContractA"] --> B["DELEGATECALL ContractA"] B --> C["sstore owner = ContractB"] C --> D["ContractB.execute cancel stream"] D --> E["Refund to ContractB treasury"] E --> F["sstore owner = Alice"] F --> G["post-check owner_ == owner passes"]

Impact#

Any value controlled by the proxy owner mid-execution (Sablier refunds, approvals, plugin installs) can be redirected to an attacker while the post-call owner check still succeeds.

Sources#

AuditVault #54672
Cantina Sablier Jul 2023
Sibling #54666 plugin collision already shipped; same PRBProxy surface

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing_exp (evm-hack-registry mirror).
AuditVault finding: 54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync