Sablier

Summary

Approved operator can't transfer the NFT associated with a stream

Vulnerability Details

From the sablier doc access-control we can know the NFT transfer function can be called by the recipient or an approved operator:

Either the recipient or an approved operator can transfer the NFT associated with a stream.

But the SablierV2Lockup#withdrawMaxAndTransfer only limit the currentRecipient can withdraw then transfer the NFT, which is not the case.

Impact

Approved operator can't transfer the NFT associated with a stream.

Tools Used

vscode, Manual Review

Recommendations

Allow the approved operator to transfer the NFT associated with a stream as well.