Sablier

Summary

SablierV2Lockup::withdrawMaxAndTransfer() can cause ERC721 token loss if newRecepient cant handle it. This issue can occur because the function use _transfer instead of safeTransferFrom function for ERC721 token.

Vulnerability Details

As can be seen above, the _transfer() function does not trigger the _checkOnERC721Received() which functions to check whether the recipient can handle the ERC721 or not.

As OpenZeppelin’s documentation stated :

Note that the caller is responsible to confirm that the recipient is capable of receiving ERC721 or else they may be permanently lost. Usage of safeTransferFrom prevents loss, though the caller must understand this adds an external call which potentially creates a reentrancy vulnerability.

Impact

ERC721 token loss if newRecepient can’t handle it

Tools Used

Manual Review

Recommended Mitigation

Use safeTransferFrom() when sending out the ERC721 token