Sablier

Vulnerability Details

When create stream, token will be transfered to contract in all contract SablierV2LockupDynamic, SablierV2LockupLinear and SablierV2LockupTranched:

    // Interaction: transfer the deposit amount.
    params.asset.safeTransferFrom({ from: msg.sender, to: address(this), value: createAmounts.deposit });

But some tokens (like cUSDCv3) contain a special case for amount == type(uint256).max in their transfer functions that results in only the user's balance being transferred. Attacker can abusing this to steal that type of token by create stream with total amount equal to special case amount and drain all of them.

Impact

That type of token will be stolen by attacker.

Tools Used

Manual review

Recommendations

Using pre and post balance check to make sure correct amount transfered to contract.