Submission Details
Severity:
Protocol don't limit the transfer function only works when the stream is transferable
Summary
The stream NFT can be transferred at any status.
Vulnerability Details
From the sablier doc access-control we can know the NFT transfer function can be called only if the stream is transferable
Only if the stream is transferable.
But the SablierV2Lockup#withdrawMaxAndTransfer don't limit the stream status is transferable, which is not the case.
Impact
The stream NFT can be transferred at any status.
Tools Used
vscode, Manual Review
Recommendations
Validity the stream NFT can be transferred only when the stream status is transferable.
Updates
Prize pool breakdown
Total prize
53,440 USDC
nSLOC
2,65520 USDC / LOC
45,000 USDC
3,100 USDC
5,340 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.