Description

The _update function in the SablierV2Lockup smart contract is responsible for updating the ownership of an NFT representing a stream. It checks whether the stream is marked as transferable but does not verify the stream's current status (e.g., if it is settled or depleted).

Impact

The absence of a status check could lead to scenarios where an NFT representing a settled or depleted stream is transferred, potentially causing confusion among users. It may also lead to unnecessary transactions and gas expenditure.

Proof of Concept

a user attempting to transfer an NFT representing a stream that has already been settled or depleted. Without a status check, the transfer may succeed, leading the user to believe the stream is still active or has value, which is not the case. This could result in the recipient of the transfer incorrectly assuming they have acquired an active stream, only to find out it has no remaining value or cannot be interacted with as expected.

Tools Used

Manual review

Recommendations

Enhance the _update function with additional checks to verify the stream's status. This could involve checking if the stream is settled or depleted and preventing the transfer if it does not meet the criteria for an active and valid stream.