Sablier

Summary

missing check that funder is not the recipient in _create()

Vulnerability Details

a user can make mistakes while setting any of the params, thats why we do multiple checks in different places like here and here
but the function doesn't ever check if the recipient != msg.sender which may happen by mistake cause no protocol owner ever want to airdrop his wallet from his deducted balance

Impact

unintended behavior and forced waiting lock period to retrieve funds

Tools Used

manual review

Recommendations

add a requirement that funder != receiver