Sablier

Summary

Users can receive streaming using the withdraw.
Users can try to withdraw current available amount using this function.
However, malicious users can prevent this by front-withdrawing just 1 wei, causing the user's transaction to revert.

This not only reverts the transaction but also prevents users from receiving their streams.
Users might not recognize the revert reason and try again several times, but they won't achieve the expected result.

When user wants to withdraw some amounts, there is still an attack vector where a malicious user front-runs and withdraws a specific amount, leaving just 1 wei less than the amount requested by the user.

Vulnerability Details

Users can receive current available streaming by calling the withdraw function.

However, an attacker can withdraw 1 wei by front-running the transaction.
This causes the user's transaction to revert, leaving them with only 1 wei from the attacker's action.

In the test below, the reason for the revert is as follows:

Please add below test to the test/integration/concrete/lockup-linear/create-with-timestamps/createWithTimestamps.t.sol:

Impact

I believe this issue is more severe than a typical gas griefing attack.
In a normal gas griefing attack, the user's transaction is reverted, but they eventually achieve the expected result by attacker.
In this case, users do not receive their streams at all.

Tools Used

Manual

Recommendations

If the requested amount is larger than the current available amount, simply use the current available amount, as is done in most protocols.