Summary

In SablierV2NFTDescriptor::tokenURI, there is no validation if the sablier and streamId are valid. This will allow malicious user to submit malicious parameters that lead to injection attack.

Vulnerability Details

As the function is callable by anyone and there is no validation for the parameters sablier and streamId, an attacker can create his own malicious sablier and streamId. This results in a malformed JSON output with injected attributes.

Impact

Such a vulnerability can lead to potential misinformation, unexpected behaviour and other security risks on platforms that consume this JSON.

Tools Used

Manual Review

Recommendations

Add checks to validate that sablier and streamId are valid.