Sablier

Vulnerability Description

The Sablier V2 Lockup Linear contract constructor includes an initialAdmin argument. This argument allows specifying an address to be granted the initial admin privileges within the contract. If this argument is set to a value different from msg.sender (the address deploying the contract), it creates a centralization issue:

The deployer relinquishes control over the contract to another entity.
The initial admin can potentially perform critical actions that could compromise the contract's functionality or user funds.

Potential Impacts

Centralized Control: An attacker could exploit a compromised initial admin account to gain unauthorized control. This could involve manipulating data, stealing funds locked within streams, or disrupting contract operations.
Privilege Escalation: Even if the initial admin is a trusted party, it introduces a single point of failure. If their account is compromised, the attacker gains elevated privileges within the contract.