Sablier

Vulnerability Details

In SablierV2MerkleLL, constructor approve token with (uint256).max value:

constructor(
    MerkleLockup.ConstructorParams memory baseParams,
    ISablierV2LockupLinear lockupLinear,
    LockupLinear.Durations memory streamDurations_
)
    SablierV2MerkleLockup(baseParams)
{
    LOCKUP_LINEAR = lockupLinear;
    streamDurations = streamDurations_;

    // Max approve the Sablier contract to spend funds from the MerkleLockup contract.
    ASSET.forceApprove(address(LOCKUP_LINEAR), type(uint256).max);   //  <---
}

Some tokens like UNI or COMP revert when approve with big number link, which will lead to constructor revert

Impact

Some token are not able to be used in the protocol due to revert on large approve

Tools Used

Manual review

Recommendations

Only approve with necessary number when transfer token.