Summary

The protocol is not compatible with fee-on-transfer tokens.

Vulnerability Details

For example, in the SablierV2LockupTranched::_create() function, the createAmounts.deposit is saved to the stream, L233:

And the depositor transfers createAmounts.deposit amount of asset token to the contract.

If the asset is a fee-on-transfer token, the token amount received by the contract is less than createAmounts.deposit due to the transfer fee.

Impact

The stream would have insufficient tokent to distribute.

Tools Used

vscode

Recommendations

Update the relavant codes and track the token amount the contract received.